Critical WordPress Plugin Bugs Exploited En Masse
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-11972 | Missing Authorization in Hunk Companion Plugin Allows Unauthenticated Plugin Install | 9.8 | 59% | PoC | |
| CVE-2024-9234 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a… | 9.8 | 10% | ||
| CVE-2024-9707 | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the… | 9.8 | 9% |
From the original article
2 min read at infosecurity-magazine.com
Threat actors are attempting to exploit three critical CVEs from 2024 impacting two popular WordPress plugins, according to Wordfence. The security vendor claimed that the bugs affect the GutenKit and Hunk Companion plugins which have over 40,000 and 8000 active installations respectively.
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.