WordPress Plugin Flaw Lets Hackers Install Vulnerable Add-ons

December 12, 2024December 12, 2024

Critical Vulnerability in Hunk Companion Plugin Poses Major Security Risks for WordPress Users

Malicious actors are currently exploiting a critical vulnerability in the Hunk Companion plugin for WordPress, potentially jeopardizing the security of over 10,000 active installations. This flaw, identified as CVE-2024-11972, has a staggering CVSS score of 9.8, indicating its severity. If left unaddressed, this vulnerability could allow attackers to install additional vulnerable plugins, leading to various types of cyberattacks.

According to WPScan, the security risk associated with this flaw is significant. Attackers can exploit it to install unprotected or outdated plugins, which may facilitate attacks such as Remote Code Execution (RCE), SQL Injection, Cross-Site Scripting (XSS), and the creation of administrative backdoors. The implications of these exploits can be dire, as they may enable unauthorized access and control over WordPress sites.

Understanding the Vulnerability in Hunk Companion

The vulnerability affects all versions of the Hunk Companion plugin prior to version 1.9.0. WPScan discovered the defect while analyzing an infection on a WordPress site, where attackers were using it to install a now-closed plugin called WP Query Console. This installation opened the door for further exploitation through an unpatched zero-day RCE flaw, tracked as CVE-2024-50498, which has a perfect CVSS score of 10.0.

Key Details about CVE-2024-11972:
- Affected Versions: All versions before 1.9.0
- CVSS Score: 9.8
- Exploitation Methods: RCE, SQL Injection, XSS, administrative backdoors

This critical vulnerability also serves as a patch bypass for another known issue, CVE-2024-9707, which similarly allows the installation or activation of unauthorized plugins. The root cause of the flaw lies in a bug within the script "hunk-companion/import/app/app.php," enabling unauthenticated requests to bypass permission checks for plugin installations.

The Importance of Securing WordPress Sites

Daniel Rodriguez from WPScan emphasizes the gravity of the situation: “What makes this attack particularly dangerous is its combination of factors—leveraging a previously patched vulnerability in Hunk Companion to install a now-removed plugin with a known Remote Code Execution flaw." This highlights the critical need for WordPress users to secure every component of their sites, especially third-party themes and plugins, which can serve as entry points for attackers.

Related Vulnerabilities in WordPress Plugins

In addition to the Hunk Companion vulnerability, Wordfence has recently reported a high-severity flaw in the WPForms plugin (CVE-2024-11205), affecting versions 1.8.4 through 1.9.2.1. This vulnerability allows authenticated attackers with Subscriber-level access and higher to refund Stripe payments and cancel subscriptions. Thankfully, this issue has been resolved in versions 1.9.2.2 and later, further emphasizing the importance of keeping WordPress plugins updated.

Stay Informed and Secure

WordPress users are urged to update their Hunk Companion plugin to version 1.9.0 or later to mitigate these risks. Regularly monitoring for updates and understanding potential vulnerabilities can significantly enhance site security.

What are your thoughts on the security of WordPress plugins? Share your insights in the comments below, and for more information on securing your WordPress site, check out our related articles on plugin vulnerabilities and cybersecurity best practices.

For the latest updates on cybersecurity threats, follow us on Twitter and LinkedIn!

Ivanti Flaw CVE-2025-0282 Under Active Exploitation

January 9, 2025January 9, 2025

Ivanti has warned of a critical security flaw, CVE-2025-0282, affecting its products, including Ivanti Connect Secure and Policy Secure, with an active exploitation reported since December 2024. This vulnerability, rated 9.0 on the CVSS scale, allows unauthenticated remote code execution, posing severe risks. Affected versions need urgent patching. Ivanti also addressed CVE-2025-0283, a high-severity privilege escalation vulnerability. Cybersecurity firm Mandiant linked attacks to the threat actor UNC5337, utilizing malware like SPAWN and PHASEJAM. Organizations are urged to upgrade systems, scan for compromises, and report any suspicious activity. CISA has added the vulnerability to its KEV catalog for immediate action.

Cisco Alerts: Decade-Old ASA WebVPN Flaw Under Attack

December 3, 2024December 12, 2024

Cisco has issued a critical alert about the active exploitation of a decade-old vulnerability, CVE-2014-2120, in its Adaptive Security Appliance (ASA). This flaw allows unauthenticated attackers to execute cross-site scripting (XSS) attacks via the WebVPN login page. The urgency is heightened by reports from CloudSEK regarding the use of this vulnerability in distributing AndroxGh0st malware, linked to the Mozi botnet. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to remediate it by December 3, 2024. Users are advised to update installations, monitor for suspicious activity, and educate employees on security risks.

CISA Warns of Critical Flaws in Mitel and Oracle Systems

January 8, 2025January 8, 2025

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, focusing on Mitel MiCollab and Oracle WebLogic Server. Notable flaws include CVE-2024-41713 (CVSS 9.1) and CVE-2024-55550 (CVSS 4.4) in MiCollab, allowing unauthorized access to system files. Additionally, CVE-2020-2883 (CVSS 9.8) in WebLogic Server permits unauthenticated access via network protocols. CISA confirmed active exploitation of these vulnerabilities, prompting federal agencies to implement updates by January 28, 2025. Organizations are urged to remain vigilant against potential attacks.

Microsoft Fixes AI, Cloud, and ERP Security Flaws; One Exploited in Active Attacks

Microsoft Patches Critical AI, Cloud Security Flaws Amid Attacks

December 1, 2024December 12, 2024

Microsoft has addressed four critical security vulnerabilities impacting its AI and cloud services, including one actively exploited flaw, CVE-2024-49035, a privilege escalation issue with a CVSS score of 8.7. This vulnerability allows unauthenticated attackers to gain elevated privileges due to improper access controls. Other vulnerabilities include CVE-2024-49038, a cross-site scripting issue, CVE-2024-49052, a missing authentication flaw in Azure PolicyWatch, and CVE-2024-49053, a spoofing issue in Dynamics 365 Sales. Users are advised to update their Dynamics 365 Sales apps to the latest version to enhance security. Regular software updates are essential for maintaining application security.

Malicious WordPress Widget Steals Credit Card Info

January 14, 2025January 14, 2025

A newly discovered WordPress credit card skimmer malware poses significant risks by stealthily capturing sensitive user information during online transactions. Identified by Sucuri researchers, the malware is hidden within the wp_options table of compromised sites and activates only on checkout URLs, creating fake payment forms that mimic legitimate gateways. It captures data in real-time and transmits it to attackers using encrypted methods. To protect against this threat, website administrators should regularly monitor their sites, update plugins and themes, implement web application firewalls, and enforce strong security practices. Staying vigilant is crucial to maintaining a secure WordPress environment.

Ivanti Releases Urgent Security Updates for CSA and Connect

December 11, 2024December 11, 2024

Ivanti has released critical security updates for its Cloud Services Application (CSA) and Connect Secure products to address multiple high-severity vulnerabilities that could lead to privilege escalation and remote code execution. Key vulnerabilities include an authentication bypass (CVE-2024-11639) and command injection flaws (CVE-2024-11772 and CVE-2024-11634) with CVSS scores reaching 10.0 and 9.1. Users are urged to update to CSA version 5.0.3 or later, Connect Secure version 22.7R2.4 or later, and other recommended versions to mitigate risks. Although no active exploitation is known, vigilance is advised due to potential past attacks.