CVE-2024-11972

🗓️ 31 Dec 2024 06:00:01Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 197 Views🌐 WEB

Unauthenticated requests allow plugin installation in Hunk Companion before version 1.9.0.

Reporter	Title	Published	Views	Family All 28
GithubExploit	Exploit for CVE-2024-11972	15 Dec 202423:54	–	githubexploit
GithubExploit	Exploit for CVE-2024-11972	29 Jan 202521:17	–	githubexploit
GithubExploit	Exploit for CVE-2024-11972	13 Jan 202515:44	–	githubexploit
Information Security Automation	New episode “In The Trend of VM” (#11): vulnerabilities that became trending in December and the final report on trending vulnerabilities for 2024	18 Feb 202517:28	–	avleonov
Information Security Automation	About Authentication Bypass – Hunk Companion WordPress plugin (CVE-2024-11972) vulnerability	11 Jan 202512:41	–	avleonov
BDU FSTEC	The vulnerability of the permission_callback function in the Hunk Companion plugin of the WordPress content management system allows a hacker to execute XSS attacks.	19 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-11972	12 Dec 202408:18	–	circl
CNNVD	WordPress plugin Hunk Companion 安全漏洞	31 Dec 202400:00	–	cnnvd
Cvelist	CVE-2024-11972 Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation	31 Dec 202406:00	–	cvelist
Exploit DB	Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation	18 Apr 202500:00	–	exploitdb

NVD

Vulners

Node

themehunk hunk_companionRange<1.9.0wordpress

[
  {
    "vendor": "Unknown",
    "product": "Hunk Companion",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.9.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/

Parameter	Position	Path	Description
params.plugin	request body	wp-json/hc/v1/themehunk-import	Unauthenticated requests can access the /wp-json/hc/v1/themehunk-import endpoint to install/activate plugins from WordPress.org without proper authorization.
params.allPlugins	request body	wp-json/hc/v1/themehunk-import	Unauthenticated requests can access the /wp-json/hc/v1/themehunk-import endpoint to install/activate plugins from WordPress.org without proper authorization.
params.themeSlug	request body	wp-json/hc/v1/themehunk-import	Unauthenticated requests can access the /wp-json/hc/v1/themehunk-import endpoint to install/activate plugins from WordPress.org without proper authorization.
params.proThemePlugin	request body	wp-json/hc/v1/themehunk-import	Unauthenticated requests can access the /wp-json/hc/v1/themehunk-import endpoint to install/activate plugins from WordPress.org without proper authorization.
params.templateType	request body	wp-json/hc/v1/themehunk-import	Unauthenticated requests can access the /wp-json/hc/v1/themehunk-import endpoint to install/activate plugins from WordPress.org without proper authorization.
params.tmplFreePro	request body	wp-json/hc/v1/themehunk-import	Unauthenticated requests can access the /wp-json/hc/v1/themehunk-import endpoint to install/activate plugins from WordPress.org without proper authorization.
params.wpUrl	request body	wp-json/hc/v1/themehunk-import	Unauthenticated requests can access the /wp-json/hc/v1/themehunk-import endpoint to install/activate plugins from WordPress.org without proper authorization.

17 Jun 2026 06:58Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.19.8

EPSS0.54475

SSVC