Critical severity9.8NVD Advisory· Published Dec 31, 2024· Updated Jun 17, 2026

CVE-2024-11972

Description

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Hunk Companionllm-fuzzy
Range: <1.9.0
WordPress/Z Companioncpe-rescue
Package: https://wordpress.org/plugins/z-companion
Themehunk/Hunk Companion
cpe:2.3:a:themehunk:hunk_companion:*:*:*:*:*:wordpress:*:*
Range: <1.9.0

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.044
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000