CVE-2024-11972

The Hunk Companion WordPress plugin, in versions before 1.9.0 , contains a critical authentication bypass vulnerability. The flaw resides in the permission_callback for the /wp-json/hc/v1/themehunk-import REST API endpoint, which is incorrectly set to __return_true. This allows unauthenticated at...

CVE-2024-9707

CVE-2024-9707 covers the Hunk Companion WordPress plugin (v1.8.4 and earlier). Multiple sources confirm a missing capability check on the REST endpoint /wp-json/hc/v1/themehunk-import, allowing unauthenticated attackers to install/activate arbitrary plugins and potentially trigger remote code exe...