Vulnerability details

CVE-2024-11972

Hunk Companion

Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

CVSS 3.1

9.8Critical

Official description

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.

CVSS scores

Score	Version	Source	Vector
9.8Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
—	Hunk Companion	v < 1.9.0	CVEProject cvelistV5 (CNA)

References and advisories

https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/ exploitvdb-entrytechnical-description

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2024-12-31
Last updated: 2024-12-31
State: Published
Assigner (CNA): WPScan

Exploit prediction (EPSS)

59.05%

Probability of exploitation in 30 days

99.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total