CVE-2024-11972
Critical
Description
The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
SeverityCritical
CVSS9.8
Exploit probability—
ProductThemehunk Hunk Companion
PublishedDec 31, 2024
First seenDec 31, 2024
Weakness typeCWE-862Missing authorization
How to fix
Update
- themehunk hunk_companion1.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| themehunk hunk_companion | v < 1.9.0 | 1.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.