CVE-2024-11972

9.8 criticalEPSS 59%

Critical (9.8) in themehunk hunk companion. EPSS 59% chance of exploitation in the next 30 days.

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 59% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
Published: 2024-12-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

themehunk:hunk_companion

References

https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/

Check your stack JSON