PT-2024-9606 · WordPress · Hunk Companion

Daniel Rodriguez · Published 2024-12-10 · Updated 2025-11-01 · CVE-2024-11972

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hunk Companion WordPress plugin versions prior to 1.9.0

Description The Hunk Companion WordPress plugin does not properly authorize certain REST API endpoints, allowing unauthenticated requests to install and activate arbitrary plugins from the WordPress.org repository, including vulnerable plugins. This issue is being actively exploited, impacting over 10,000 websites. Successful exploitation could lead to Remote Code Execution (RCE), SQL Injection, and administrative backdoors. The vulnerability allows attackers to install vulnerable plugins silently. The vulnerable API endpoints are not explicitly specified, but the issue relates to the authorization of requests to install plugins.

Recommendations Update the Hunk Companion WordPress plugin to version 1.9.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-11316

CVE-2024-11972

Affected Products

Hunk Companion

References · 55

• 🔥 https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4 · Exploit
• 🔥 https://github.com/JunTakemura/exploit-CVE-2024-11972 · Exploit
• 🔥 https://exploit-db.com/exploits/52259 · Exploit
• https://bdu.fstec.ru/vul/2024-11316 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11972 · Security Note
• https://securityonline.info/active-exploitation-observed-for-cve-2024-11972-cvss-9-8-wordpress-plugin-flaw-exposes-10000-sites-to-backdoor-attacks · Note
• https://twitter.com/pinakinit1/status/1869744545178771790 · Twitter Post
• https://twitter.com/SoBatistaCyber/status/1867183620730814490 · Twitter Post
• https://twitter.com/pdnuclei/status/1960885106165305609 · Twitter Post
• https://twitter.com/focalpointsprl/status/1867517322300211545 · Twitter Post
• https://t.me/netlas/496 · Telegram Post
• https://t.me/avleonovcom/1495 · Telegram Post
• https://t.me/zerodayalert/410 · Telegram Post
• https://reddit.com/r/CyberAlertFR/comments/1hdhm91/critical_wordpress_hunk_companion_plugin · Reddit Post