Critical WordPress Plugin Bugs Exploited En Masse
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-11972 | Missing Authorization in Hunk Companion Plugin Allows Unauthenticated Plugin Install The Hunk Companion plugin for WordPress (versions before 1.9.0) fails to properly authorize several REST API endpoints, allowing unauthenticated attackers to send crafted requests that install and activate arbitrary plugins from the WordPress.org repository. Because attackers can select plugins that are old, closed, or known to be vulnerable, the flaw can be chained into full site compromise by first staging a vulnerable plugin and then exploiting it. Any WordPress site running a Hunk Companion version prior to 1.9.0 is affected, with no privileges or user interaction required on the attacker's part (CVSS 9.8). The vulnerability is being actively exploited in the wild: Wordfence reported blocking millions of attack attempts targeting Hunk Companion and the related GutenKit flaws, and it carries a high EPSS score of 54.5%. Do: Update Hunk Companion to version 1.9.0 or later immediately. After patching, audit the plugin list for unexpectedly installed or activated plugins — especially old, closed, or known-vulnerable ones added without administrator action — and review access logs for unauthenticated requests to the REST endpoints; if updating is not yet possible, restrict unauthenticated access to the plugin's REST routes via a firewall or WAF rule. | 9.8 | 54% | PoC |
| largeon the order of 100,000+ WordPress sites (Hunk Companion ships as the companion plugin for ThemeHunk themes and Wordfence blocked ~8.7M combined attack… | |
| CVE-2024-9234 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a mis The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins. NVD description · AI analysis pending | 9.8 | 10% |
| — | ||
| CVE-2024-9707 | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/the The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. NVD description · AI analysis pending | 9.8 | 9% |
| — |
Full article383 words · extracted from infosecurity-magazine.com · click to collapse
Threat actors are attempting to exploit three critical CVEs from 2024 impacting two popular WordPress plugins, according to Wordfence.
The security vendor claimed that the bugs affect the GutenKit and Hunk Companion plugins which have over 40,000 and 8000 active installations respectively.
“These vulnerabilities make it possible for unauthenticated threat actors to install and activate arbitrary plugins, which can be leveraged to achieve remote code execution [RCE],” it warned in an update late last week.
Wordfence said it discovered the vulnerabilities via its bug bounty program on September 25 and October 3 2024. But while its customers are protected via updated firewall rules, the same is not true for all organizations using the plugins.
The vendor has already blocked nearly 8.8 million exploitation attempts, hinting at the scale of the campaign, which sprang back to life on October 8.
The three CVEs currently under exploitation are:
- CVE-2024-9234: An RCE bug which enables unauthenticated attackers to install and activate arbitrary plugins, or use the functionality to upload arbitrary files spoofed like plugins. It has a CVSS rating of 9.8 and affects all versions of the GutenKit – Page Builder Blocks, Patterns and Templates for Gutenberg Block Editor plugin, up to and including 2.1.0
- CVE-2024-9707: A critical vulnerability which makes it possible for unauthenticated attackers to install and activate arbitrary plugins. These can be used to achieve RCE if another vulnerable plugin is installed and activated. This bug has a CVSS score of 9.8 and affects all versions of the Hunk Companion plugin for WordPress up to and including 1.8.4
- CVE-2024-11972: A critical unauthorized plugin installation/activation vulnerability, which affects all versions of the Hunk Companion plugin for WordPress, up to and including 1.8.5. It has a CVSS score of 9.8. This is a bypass for CVE-2024-9707 which enables unauthenticated attackers to install and activate arbitrary plugins for RCE, if another vulnerable plugin is installed and activated
The vulnerabilities allow threat actors to “easily” hijack targeted sites by uploading PHP files and executing malicious code on the server, Wordfence warned.
The vendor released a list of attacker IP addresses and domains which could help network defenders to better improve resilience to such attacks.
Image credit: Wirestock Creators / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/critical-wordpress-plugin-bugs/