Filtered by vendor Themehunk Subscriptions
Filtered by product Hunk Companion Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-9707 1 Themehunk 1 Hunk Companion 2024-11-25 9.8 Critical
The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.