CVE-2024-11972: critical vulnerability in Hunk Companion
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
97Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 59%
from disclosure to weaponsame day
Published on NVDDec 31
1st PoCDec 15
VulnCheckDec 10
The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Hunk Companionpublic PoCs found — 7
exploitdbwww.exploit-db.com/exploits/52259unverifiedgithubgithub.com/RonF98/CVE-2024-11972-POC★ 1githubgithub.com/Nxploited/CVE-2024-11972-PoC★ 0vulncheckvulncheck.com/xdb/e83c36a3e6abunverifiedvulncheckvulncheck.com/xdb/41faf4d7f8cfunverifiedcve_referencewpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/unverifiedvulncheckvulncheck.com/xdb/45f58a456f6bunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.