by Kastro
Paper/Archive/CVE-2024-11972

CVE-2024-11972

Unknown Hunk Companion — Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

EPSS 59%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.1.991 × 2019.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.

Affected

ProductAffectedFixed inSource
Hunk Companion< 1.9.01.9.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4