CVE-2024-11972

The Hunk Companion plugin for WordPress (versions before 1.9.0) fails to properly authorize several REST API endpoints, allowing unauthenticated attackers to send crafted requests that install and activate arbitrary plugins from the WordPress.org repository. Because attackers can select plugins that are old, closed, or known to be vulnerable, the flaw can be chained into full site compromise by first staging a vulnerable plugin and then exploiting it. Any WordPress site running a Hunk Companion version prior to 1.9.0 is affected, with no privileges or user interaction required on the attacker's part (CVSS 9.8). The vulnerability is being actively exploited in the wild: Wordfence reported blocking millions of attack attempts targeting Hunk Companion and the related GutenKit flaws, and it carries a high EPSS score of 54.5%.

What to do: Update Hunk Companion to version 1.9.0 or later immediately. After patching, audit the plugin list for unexpectedly installed or activated plugins — especially old, closed, or known-vulnerable ones added without administrator action — and review access logs for unauthenticated requests to the REST endpoints; if updating is not yet possible, restrict unauthenticated access to the plugin's REST routes via a firewall or WAF rule.