A critical vulnerability in the “Hunk Companion” WordPress plugin is being actively exploited by hackers.
This flaw allows attackers to remotely install other plugins, including those with known vulnerabilities, directly from the WordPress.org repository.
Security researchers at WPScan discovered the vulnerability (CVE-2024-11972), which affects all versions of Hunk Companion before 1.9.0. The plugin, used by over 10,000 WordPress websites, is designed to enhance the functionality of themes developed by ThemeHunk.
Attackers Leverage Vulnerability to Install Malicious Plugins
By exploiting this vulnerability, attackers can install outdated plugins with known security flaws, such as WP Query Console, which contains a remote code execution (RCE) vulnerability (CVE-2024-50498). This allows attackers to gain control over the website, potentially enabling them to steal data, inject malicious code, and create backdoors for future access.
Website owners using the Hunk Companion plugin are urged to update to version 1.9.0 or later immediately to patch this critical vulnerability and mitigate the risk of exploitation.
