Vulnerability · Published Dec 31, 2024 · Assigned by WPScan

CVE-2024-11972Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

Critical 9.8

In plain English

A critical-severity security flaw in Hunk Companion from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 59.1% (higher than 99.1% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)59.1%top 0.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Hunk Companion	0 – before 1.9.0

References

https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/ exploit, vdb-entry, technical-description