Mass WordPress exploit targets GutenKit and Hunk Companion flaws

Security researchers warned that a mass exploitation campaign beginning on October 8 is targeting WordPress sites running two plugins, GutenKit and Hunk Companion, using three critical vulnerabilities that allow unauthenticated attackers to install arbitrary plugins and potentially achieve remote code execution. Wordfence, a WordPress security firm, said its firewall blocked about 8.7 million exploit attempts against its customers over a 48 hour period as the campaign intensified.

The flaws, tracked as CVE20249234, CVE20249707 and CVE202411972, are critical and rated CVSS 9.8. Wordfence said CVE20249234 is an unauthenticated REST endpoint issue in GutenKit, which has roughly 40,000 active installs and can be abused to download and install plugin packages without authentication. The other two flaws are missing authorization checks in Hunk Companion’s themehunkimport REST endpoint, affecting about 8,000 installs, and likewise permit remote plugin installation. An attacker can use those capabilities to add a second, vulnerable plugin that enables remote code execution.

Researchers reported that a malicious plugin archive hosted on GitHub under the name up has been used in the...