The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/ | Exploit Third Party Advisory |
Configurations
History
17 May 2025, 02:22
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Themehunk hunk Companion
Themehunk |
|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:themehunk:hunk_companion:*:*:*:*:*:wordpress:*:* | |
| References | () https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/ - Exploit, Third Party Advisory |
31 Dec 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-12-31 06:15
Updated : 2025-05-17 02:22
NVD link : CVE-2024-11972
Mitre link : CVE-2024-11972
JSON object : View
Products Affected
themehunk
- hunk_companion
CWE