CVE-2024-11972

Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.

Affected

Hunk Companion

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

59.05% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical

Published

2024-12-31

Proof-of-concept exploits (3)

• https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/
• Nxploited/CVE-2024-11972-PoC0★ · 2025-01-29
• RonF98/CVE-2024-11972-POC1★ · 2025-07-07

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11972.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52259

Security advisories

• https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4

References

• CVE Record
• NVD entry

Related

• CVE-2023-21716
• CVE-2023-38831
• CVE-2023-6000
• CVE-2024-43451