Threat actors have been exploiting two vulnerabilities in the Hunk Companion and WP Query Console WordPress plugins to gain persistent backdoor access to vulnerable websites, WPScan reports.
Hunk Companion, a website development plugin designed to boost the functionality of ThemeHunk WordPress themes, is vulnerable to a missing capability check that allows attackers to install and activate plugins without authorization.
Tracked as CVE‑2024‑9707 (CVSS score of 9.8), the bug allows “unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated”, a NIST advisory reads.
A patch for the security defect was included in Hunk Companion version 1.8.5, which was released in October, but WPScan says that the fix was not efficient and that version 1.8.7 of the plugin was found vulnerable as well.
A new patch was rolled out on December 10, in Hunk Companion version 1.9.0. According to WordPress data, roughly 90% of the plugin’s 10,000 installations are likely running an unpatched iteration.
Over the past 24 hours, WordPress security firm Defiance blocked over 56,000 attacks targeting the Hunk Companion vulnerability.
WPScan has observed threat actors exploiting vulnerable Hunk Companion instances to install and activate WP Query Console, a WordPress query testing plugin that has not been updated for the past seven years, and which is affected by a remote code execution (RCE) flaw.
Tracked as CVE-2024-50498 (CVSS score of 9.8), the vulnerability is described as a code injection defect that impacts all versions of WP Query Console. The plugin was closed on October 21, one week before the flaw was publicly disclosed.
The issue “could allow a malicious actor to execute commands on the target website. This can be used to gain backdoor access to then take full control of the website,” notes Patchstack, which released a virtual fix in October.
WordPress data shows that, although the plugin was closed in October, it was downloaded hundreds of times since late November, which suggests that threat actors might have been abusing it in mass-exploitation campaigns.
Hunk Companion users are advised to update their installations to version 1.9.0 as soon as possible. Administrators should also check their websites for any signs of intrusion, such as the unauthorized installation of WP Query Console or other WordPress plugins.
Related: Critical Vulnerabilities Found in Anti-Spam Plugin Used by 200,000 WordPress Sites
Related: Critical Plugin Flaw Exposed 4 Million WordPress Websites to Takeover
Related: Mercenary Cyberspies Used Autodesk 3ds Max Exploits in Attacks
