WordPress Hunk Companion Plugin Flaw Exploited to Silently Install Malicious Plugins
Malicious actors are installing other susceptible plugins that could lead to a number of attacks by taking advantage of a serious flaw in the WordPress plugin Hunk Companion.
The vulnerability, identified as CVE-2024-11972 (CVSS score: 9.8), impacts all plugin versions before 1.9.0. There are more than 10,000 active installs of the plugin.
According to a report by WPScan, this vulnerability presents a serious security risk since it allows hackers to install closed or vulnerable plugins, which can subsequently be used for attacks like SQL Injection, Cross-Site Scripting (XSS), Remote Code Execution (RCE), or even the establishment of administrative backdoors read more about WordPress Hunk Companion Plugin Flaw Exploited to Silently Install Malicious Plugins.
Get up to date on the ...