PT-2024-34276 · WordPress · Hunk Companion+1

Stealthcopter · Published 2024-10-28 · Updated 2026-01-23 · CVE-2024-50498

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WP Query Console versions n/a through 1.0 Hunk Companion versions prior to 1.9.0

Description: The issue is related to an Improper Control of Generation of Code ('Code Injection') vulnerability, which allows code injection. This vulnerability affects WP Query Console and can be used to execute commands on the target website, potentially leading to backdoor access and full control over the website. According to WPScan, hackers have been using vulnerabilities in Hunk Companion and WP Query Console plugins to gain permanent backdoor access to vulnerable WordPress websites. Approximately 90% of the 10,000 installations of the Hunk Companion plugin are reportedly still running on unpatched versions. Defiance has blocked over 56,000 attacks targeting the Hunk Companion vulnerability in the last 24 hours.

Recommendations: For WP Query Console versions n/a through 1.0: Immediate deactivation and uninstallation are recommended. For Hunk Companion versions prior to 1.9.0: Update to version 1.9.0 as soon as possible and check the site for signs of intrusion, including the installation of WP Query Console or other plugins.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-50498

Affected Products

Hunk Companion

Wp Query Console

References · 18

• 🔥 https://github.com/JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-50498 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-50498 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50498 · Vendor Advisory
• https://patchstack.com/database/Wordpress/Plugin/wp-query-console/vulnerability/wordpress-wp-query-console-plugin-1-0-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://reddit.com/r/Action1/comments/1i1d6m5/the_first_patch_tuesday_of_2025_is_here · Reddit Post
• https://t.me/cvenotify/99716 · Telegram Post
• https://twitter.com/Nxploited/status/1875397833911889994 · Twitter Post
• https://t.me/true_secator/6534 · Telegram Post
• https://twitter.com/JoshuaProvoste/status/1858512517774868845 · Twitter Post
• https://t.me/cveNotify/149705 · Telegram Post
• https://t.me/secharvester/17749 · Telegram Post
• https://t.me/latest_high_impact_cve/1403 · Telegram Post
• https://patchstack.com/database/vulnerability/wp-query-console/wordpress-wp-query-console-plugin-1-0-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://twitter.com/OstorlabSec/status/1864683107653181551 · Twitter Post
• https://t.me/cvedetector/9094 · Telegram Post