Wordfence blocks 8.7M attacks exploiting old GutenKit and Hunk Companion flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-11972 | Missing Authorization in Hunk Companion Plugin Allows Unauthenticated Plugin Install The Hunk Companion plugin for WordPress (versions before 1.9.0) fails to properly authorize several REST API endpoints, allowing unauthenticated attackers to send crafted requests that install and activate arbitrary plugins from the WordPress.org repository. Because attackers can select plugins that are old, closed, or known to be vulnerable, the flaw can be chained into full site compromise by first staging a vulnerable plugin and then exploiting it. Any WordPress site running a Hunk Companion version prior to 1.9.0 is affected, with no privileges or user interaction required on the attacker's part (CVSS 9.8). The vulnerability is being actively exploited in the wild: Wordfence reported blocking millions of attack attempts targeting Hunk Companion and the related GutenKit flaws, and it carries a high EPSS score of 54.5%. Do: Update Hunk Companion to version 1.9.0 or later immediately. After patching, audit the plugin list for unexpectedly installed or activated plugins — especially old, closed, or known-vulnerable ones added without administrator action — and review access logs for unauthenticated requests to the REST endpoints; if updating is not yet possible, restrict unauthenticated access to the plugin's REST routes via a firewall or WAF rule. | 9.8 | 54% | PoC |
| largeon the order of 100,000+ WordPress sites (Hunk Companion ships as the companion plugin for ThemeHunk themes and Wordfence blocked ~8.7M combined attack… | |
| CVE-2024-9234 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a mis The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins. NVD description · AI analysis pending | 9.8 | 10% |
| — | ||
| CVE-2024-9707 | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/the The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. NVD description · AI analysis pending | 9.8 | 9% |
| — |
Full article509 words · extracted from securityaffairs.com · click to collapse
Hackers exploited old RCE flaws in WordPress GutenKit and Hunk Companion plugins. Wordfence firm blocked 8.7M attacks in two days.
In September and October 2024, submissions revealed Arbitrary Plugin Installation vulnerabilities in GutenKit and Hunk Companion WordPress plugins, with 40,000 and 8,000+ installs, respectively. These flaws allow unauthenticated attackers to install plugins and achieve RCE.
Wordfence researchers reported that threat actors are exploiting these flaws in the above plugins and blocked 8.7M attacks in two days, October 8–9.
“On September 25th, 2024, and on October 3rd, 2024, we received submissions through our Bug Bounty Program for Arbitrary Plugin Installation vulnerabilities in the GutenKit and Hunk Companion WordPress plugins, which have over 40,000 and 8,000 active installations, respectively.” reads the report published by Wordfence. “Our records indicate that attackers most recently started mass exploiting the issues again on October 8th, 2025 (approximately one year later), following several earlier incidents of large-scale exploitation. The Wordfence Firewall has already blocked over 8,755,000 exploit attempts targeting these vulnerabilities.”
The flaws exploited by the attackers are: (CVSS 9.8).
- CVE-2024-9234 (CVSS score of 9.8) is an unauthenticated REST-endpoint flaw in the GutenKit plugin that allows unauthenticated attackers to install arbitrary plugins.
- CVE-2024-9707 (CVSS score of 9.8) and CVE-2024-11972 (CVSS score of 9.8) are missing-authorization flaws in the Hunk Companion plugin’s
themehunk-importREST endpoint. An unauthenticated attacker can exploit them to install arbitrary plugins.
Code review shows both GutenKit and Hunk Companion register REST endpoints with ‘permission_callback’ set to true, making them public. GutenKit’s install-active-plugin downloads and unzips remote plugin ZIPs without auth, enabling unauthenticated plugin install/activate and potential RCE. Hunk Companion’s themehunk-import similarly allows similar attacks.
Attack data shows mass exploit attempts against GutenKit and Hunk Companion. Attackers used GutenKit’s REST endpoint requests to call GutenKit’s install-active-plugin to fetch a malicious ZIP from GitHub (slug “up”) containing obfuscated backdoors, file managers and a PDF-headed vv.php with malicious payloads.
“A file named vv.php starts with a valid PDF header but contains malicious PHP code which again is heavily obfuscated. It executes several function calls including string reversals, decompression and conversion steps on an included payload.” continues the report. “Decoded, the sample proves to be a tool with mass-defacement, file management, and network-sniffing capabilities. It also provides a terminal, remote code execution and can be used to install further malware.”
Wordfence blocked over 8,755,000 attempts, with top IPs made tens–hundreds of thousands of requests. The researchers observed that attacks resumed Oct 8–9, 2025, a year after disclosure.
Wordfence shared several IPs involved in the campaign. Admins should check logs for /wp-json/gutenkit/v1/install-active-plugin and /wp-json/hc/v1/themehunk-import requests, and inspect /up, /background-image-cropper, /ultra-seo-processor-wp, /oke, and /wp-query-console folders for rogue files. Keeping plugins updated is strongly advised.
“The attackers are attempting to install plugins with embedded malicious PHP code onto websites. It is recommended to review the /wp-content/plugins and /wp-content/upgrade directories for any suspicious or unknown plugin directories.” concludes the report “Make sure Wordfence is configured to scan files in these directories.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, plugins)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/183876/uncategorized/wordfence-blocks-8-7m-attacks-exploiting-old-gutenkit-and-hunk-companion-flaws.html