Critical WordPress Vulnerabilities Exploited in Hunk Companion and WPForms Plugins

Malicious actors are exploiting critical vulnerabilities in popular WordPress plugins to compromise websites and launch a variety of attacks.

Hunk Companion Vulnerability

One of the affected plugins is Hunk Companion, which has over 10,000 active installations. A flaw, tracked as CVE-2024-11972 (CVSS score: 9.8), impacts all plugin versions prior to 1.9.0. This vulnerability enables attackers to install vulnerable or deprecated plugins, paving the way for attacks like:

1. Remote Code Execution (RCE)
2. SQL Injection
3. Cross-Site Scripting (XSS)
4. Creation of administrative backdoors

WPScan researchers uncovered the issue while analyzing an infection on an unnamed WordPress site. Threat actors exploited the flaw to install a now-closed plugin called WP Query Console, leveraging an unpatched zero-day RCE vulnerability (CVE-2024-50498) in the plugin to execute malicious PHP code.

The issue in Hunk Companion stems from a bug in the script hunk‑companion/import/app/app.php, which allows unauthenticated users to bypass permission checks for installing plugins. This flaw is also a patch bypass for another vulnerability, CVE-2024-9707, fixed in version 1.8.5.

Compounding Risks

The exploitation chain, combining patched and unpatched vulnerabilities, highlights the danger of outdated or abandoned plugins. Attackers can use these plugins to:

1. Circumvent security measures
2. Tamper with database records
3. Inject malicious scripts
4. Gain complete control over websites

“This attack's sophistication emphasizes the need for rigorous security across all WordPress components, especially third-party plugins and themes,” said WPScan’s Daniel Rodriguez.

WPForms Vulnerability

In addition, Wordfence disclosed a high-severity flaw in the WPForms plugin, which is installed on over 6 million sites. Tracked as CVE-2024-11205 (CVSS score: 8.5), the flaw allows authenticated users with Subscriber-level access and above to:

1. Refund Stripe payments
2. Cancel subscriptions

This vulnerability affects versions 1.8.4 to 1.9.2.1 and has been resolved in version 1.9.2.2 or later.

Securing Your WordPress Site

These developments underline the critical importance of:

1. Regularly updating plugins and themes to their latest versions.
2. Auditing installed plugins to remove abandoned or vulnerable components.
3. Implementing security measures such as web application firewalls (WAFs) to detect and block exploitation attempts.

For Hunk Companion users, upgrading to version 1.9.0 or higher is essential to mitigate CVE-2024-11972. Similarly, WPForms users should ensure they are running version 1.9.2.2 or later.

By proactively addressing vulnerabilities and securing all components of a WordPress installation, administrators can reduce their exposure to sophisticated attacks.