Serious vulnerability for Hunk Companion, a WordPress plugin installed on over 10 thousand pages on the internet

One of the serious flaw of security was found recently in the appendix Hunk Companion for WordPressused in over 10,000 pages on the internet. The weakness is labeled CVE-2024-11972, and it is set to a score ashpërsie of 9.8 out of 10 because it allows the installation and activation of the subsidiaries of arbitrary by the requirements of the paautentikuara, being exposed, and the pages on attack of the potential of the performance of the remote (RCE).

The weakness was disclosed by the WPScan in a survey carried out on the basis of komprometimit to the website of a client. The attackers used the problem to install the attachment WP Query Consolenow an old woman, and without a up-to-date for many years, and which has a vulnerability and its critical (CVE-2024-50498), with an output of maximum intensity of 10. In this way, the hackers can execute the code to the harmful effects and to maintain access to a constant in the pages of the komprometuara.

Indian Hunk Companion was updated to version 1.9.0 couple of days ago to fix the problem, but so far, it appears that the only 16.5% of the users have to apply this patch so far, leaving about 8000 sites are still vulnerable to attacks. A weakness of the like (CVE-2024-9707) was rregullua in a previous version of the appendix (1.8.5), but the measures have to be enough.

The researchers in the security indicated that a combination of factors, including the use of supplements is that they are obsolete, or deleted from the storage room to the official WordPress, enhancing the risks associated with these attacks. In addition, it is not clear whether the mechanism that allows for the removal of the supplements are still active, while raising further concerns for the safety and security.

The administrators of the website WordPress and are advised to update immediately (see section Hunk Companion to version 1.9.0 and to check for any sign of compromise, as well as the installation, unauthorized, the subsidiaries or the time to be seen on the servers of their own.