Critical WordPress plugin vulnerability under active exploit threatens thousands
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-11972 | Missing Authorization in Hunk Companion Plugin Allows Unauthenticated Plugin Install The Hunk Companion plugin for WordPress (versions before 1.9.0) fails to properly authorize several REST API endpoints, allowing unauthenticated attackers to send crafted requests that install and activate arbitrary plugins from the WordPress.org repository. Because attackers can select plugins that are old, closed, or known to be vulnerable, the flaw can be chained into full site compromise by first staging a vulnerable plugin and then exploiting it. Any WordPress site running a Hunk Companion version prior to 1.9.0 is affected, with no privileges or user interaction required on the attacker's part (CVSS 9.8). The vulnerability is being actively exploited in the wild: Wordfence reported blocking millions of attack attempts targeting Hunk Companion and the related GutenKit flaws, and it carries a high EPSS score of 54.5%. Do: Update Hunk Companion to version 1.9.0 or later immediately. After patching, audit the plugin list for unexpectedly installed or activated plugins — especially old, closed, or known-vulnerable ones added without administrator action — and review access logs for unauthenticated requests to the REST endpoints; if updating is not yet possible, restrict unauthenticated access to the plugin's REST routes via a firewall or WAF rule. | 9.8 | 54% | PoC |
| largeon the order of 100,000+ WordPress sites (Hunk Companion ships as the companion plugin for ThemeHunk themes and Wordfence blocked ~8.7M combined attack… |
Full article229 words · extracted from arstechnica.com · click to collapse
Thousands of sites running WordPress remain unpatched against a critical security flaw in a widely used plugin that was being actively exploited in attacks that allow for unauthenticated execution of malicious code, security researchers said.
The vulnerability, tracked as CVE-2024-11972, is found in Hunk Companion, a plugin that runs on 10,000 sites that use the WordPress content management system. The vulnerability, which carries a severity rating of 9.8 out of a possible 10, was patched earlier this week. At the time this post went live on Ars, figures provided on the Hunk Companion page indicated that less than 12 percent of users had installed the patch, meaning nearly 9,000 sites could be next to be targeted.
Significant, multifaceted threat
“This vulnerability represents a significant and multifaceted threat, targeting sites that use both a ThemeHunk theme and the Hunk Companion plugin,” Daniel Rodriguez, a researcher with WordPress security firm WP Scan, wrote. “With over 10,000 active installations, this exposed thousands of websites to anonymous, unauthenticated attacks capable of severely compromising their integrity.”
Rodriquez said WP Scan discovered the vulnerability while analyzing the compromise of a customer’s site. The firm found that the initial vector was CVE-2024-11972. The exploit allowed the hackers behind the attack to cause vulnerable sites to automatically navigate to wordpress.org and download WP Query Console, a plugin that hasn’t been updated in years.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/security/2024/12/thousands-of-sites-remain-unpatched-against-actively-exploited-wordpress-plugin-bug/