{"id":"CVE-2024-11972","aliases":["EUVD-2024-34370","GHSA-pp53-3m4v-vvmw"],"status":"published","title":"Hunk Companion \u003c 1.9.0 - Unauthenticated Plugin Installation","description":"The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.59055,"percentile":0.9912,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2024-12-31T06:00:01Z","modified":"2026-06-17T06:58:48Z","exploits":[{"source":"exploitdb","id":"EDB-52259","title":"Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation","type":"webapps","platform":"multiple","date":"2025-04-18","url":"https://www.exploit-db.com/exploits/52259"},{"source":"nuclei","id":"CVE-2024-11972","title":"Hunk Companion \u003c 1.9.0 - Unauthenticated Plugin Installation","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11972.yaml"},{"source":"pocgithub","id":"Nxploited/CVE-2024-11972-PoC","title":"Nxploited/CVE-2024-11972-PoC","date":"2025-01-29","url":"https://github.com/Nxploited/CVE-2024-11972-PoC"},{"source":"pocgithub","id":"RonF98/CVE-2024-11972-POC","title":"RonF98/CVE-2024-11972-POC","date":"2025-01-13","url":"https://github.com/RonF98/CVE-2024-11972-POC"}],"products":[{"vendor":"themehunk","product":"hunk companion"},{"vendor":"themehunk","product":"hunk_companion"},{"vendor":"unknown","product":"hunk companion"}],"references":[{"url":"https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11972"},{"url":"https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4"},{"url":"https://github.com/advisories/GHSA-pp53-3m4v-vvmw"}],"sources":{"cve":[{"id":"CVE-2024-11972","title":"Hunk Companion \u003c 1.9.0 - Unauthenticated Plugin Installation","description":"The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.","status":"published","published":"2024-12-31T06:00:01.751Z","modified":"2024-12-31T18:14:10.608Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:34:19.615831Z"}],"euvd":[{"id":"EUVD-2024-34370","description":"The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.","status":"published","published":"2024-12-31T06:00:01Z","modified":"2024-12-31T18:14:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:31.712293Z"}],"ghsa":[{"id":"GHSA-pp53-3m4v-vvmw","title":"The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API...","description":"The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.","status":"published","published":"2024-12-31T06:30:54Z","modified":"2024-12-31T21:31:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:59:18.102288Z"}],"nvd":[{"id":"CVE-2024-11972","description":"The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.","status":"published","published":"2024-12-31T06:15:23.777Z","modified":"2026-06-17T06:58:48.51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:41.489236Z"}]}}