What’s Vulnerable › Vulnerabilities

CVE-2024-9707: Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-10-11 · updated 2026-06-17
• Weakness: CWE-862

Description

The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

Affected products

• Hunk Companion: before 1.8.5 — fixed in 1.8.5

How to fix

Upgrade to a fixed version: Hunk Companion 1.8.5. Check the vendor advisory for mitigations.

References

• https://github.com/WordPressBugBounty/plugins-hunk-companion/blob/5a3cedc7b3d35d407b210e691c53c6cb400e4051/hunk-companion/import/app/app.php#L46
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3166501%40hunk-companion&new=3166501%40hunk-companion&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/hunk-companion/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9c101fca-037c-4bed-9dc7-baa021a8b59c?source=cve

Get alerted when CVE-2024-9707 or the next vulnerability affects your stack