WordPress Hunk Companion Plugin Flaw Exploited to Silently Install Vulnerable Plugins

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.

The Hunk Companion plugin for WordPress (versions before 1.9.0) fails to properly authorize several REST API endpoints, allowing unauthenticated attackers to send crafted requests that install and activate arbitrary plugins from the WordPress.org repository. Because attackers can select plugins that are old, closed, or known to be vulnerable, the flaw can be chained into full site compromise by first staging a vulnerable plugin and then exploiting it. Any WordPress site running a Hunk Companion version prior to 1.9.0 is affected, with no privileges or user interaction required on the attacker's part (CVSS 9.8). The vulnerability is being actively exploited in the wild: Wordfence reported blocking millions of attack attempts targeting Hunk Companion and the related GutenKit flaws, and it carries a high EPSS score of 54.5%.

Do: Update Hunk Companion to version 1.9.0 or later immediately. After patching, audit the plugin list for unexpectedly installed or activated plugins — especially old, closed, or known-vulnerable ones added without administrator action — and review access logs for unauthenticated requests to the REST endpoints; if updating is not yet possible, restrict unauthenticated access to the plugin's REST routes via a firewall or WAF rule.

CVE-2024-50498 is an improper control of code generation (CWE-94) flaw in the WP Query Console WordPress plugin by Ajit Bohra/LUBUS, allowing remote code injection. According to the CVSS vector, it is exploitable over the network with low complexity, no privileges and no user interaction, meaning an unauthenticated attacker can trigger it by sending a crafted request to an affected site. Successful exploitation yields full remote code execution impact (high confidentiality, integrity and availability), letting the attacker run arbitrary code on the WordPress host. Any WordPress site running WP Query Console version 1.0 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, though its EPSS score is high (~53% chance of exploitation within 30 days) and related reporting describes attackers chaining WordPress plugin flaws (e.g., the Hunk Companion issue) to silently install vulnerable plugins, which could bring this plugin onto otherwise unaffected sites.

Do: Update WP Query Console to a version newer than 1.0 (the latest patched release) or deactivate and delete the plugin if it is not actively needed, since it is a developer tool rarely required in production. Internet-facing WordPress sites should be prioritized given the critical severity and high EPSS score. Check whether the related Hunk Companion plugin flaw was used to silently install WP Query Console or other vulnerable plugins on your sites.