CVE-2024-11972: Hunk Companion Auth Bypass Vulnerability

CVE-2024-11972 Overview

CVE-2024-11972 is an Authorization Bypass vulnerability affecting the Hunk Companion WordPress plugin. The plugin fails to correctly authorize certain REST API endpoints, allowing unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository—including vulnerable plugins that have been closed or delisted. This vulnerability can be chained with other exploits to achieve full site compromise.

Critical Impact

Unauthenticated attackers can install and activate arbitrary WordPress plugins, including known-vulnerable plugins, enabling further exploitation and potential complete site takeover.

Affected Products

• Hunk Companion WordPress plugin versions prior to 1.9.0
• WordPress sites using ThemeHunk themes with Hunk Companion installed
• Any WordPress installation with the vulnerable Hunk Companion plugin active

Discovery Timeline

• 2024-12-31 - CVE-2024-11972 published to NVD
• 2025-05-17 - Last updated in NVD database

Technical Details for CVE-2024-11972

Vulnerability Analysis

This vulnerability stems from improper authorization controls on REST API endpoints within the Hunk Companion plugin. The plugin exposes functionality that allows plugin installation and activation through its REST API, but fails to implement proper authentication checks on these sensitive endpoints. As a result, unauthenticated users can send requests to these endpoints and trigger plugin installations without any valid credentials or nonce verification.

The most dangerous aspect of this vulnerability is the ability to install plugins that have been closed on WordPress.org due to security issues. WordPress.org maintains a repository where vulnerable plugins are sometimes delisted but remain installable via direct API calls. An attacker exploiting CVE-2024-11972 can install these known-vulnerable plugins, then chain exploits to achieve remote code execution or other severe impacts.

Root Cause

The root cause is inadequate permission checking on REST API route handlers within the Hunk Companion plugin. The affected endpoints lack proper capability checks and nonce validation, allowing any remote user to invoke privileged plugin management functionality. This represents a Broken Access Control vulnerability where authentication requirements are either missing or improperly implemented for sensitive administrative operations.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft HTTP requests to the vulnerable REST API endpoints to:

1. Enumerate available plugins from the WordPress.org repository
2. Request installation of arbitrary plugins, including closed/vulnerable ones
3. Activate installed plugins to enable their functionality
4. Chain with vulnerabilities in the installed plugins for further exploitation

The vulnerability is particularly dangerous because it can be exploited remotely without any prior access to the WordPress site. The attacker does not need valid WordPress credentials or session cookies—they simply need to identify a site running a vulnerable version of Hunk Companion and send crafted API requests.

Detection Methods for CVE-2024-11972

Indicators of Compromise

• Unexpected plugins appearing in the WordPress plugins directory, especially plugins that are no longer listed on WordPress.org
• Unusual REST API requests to Hunk Companion endpoints in web server access logs
• New or modified plugin files with recent timestamps that don't correlate with administrative activity
• Evidence of plugin activation events in WordPress logs without corresponding admin user sessions

Detection Strategies

• Monitor WordPress REST API logs for unauthenticated requests targeting Hunk Companion endpoints
• Implement file integrity monitoring on the wp-content/plugins/ directory to detect unauthorized plugin installations
• Review web application firewall (WAF) logs for suspicious POST requests to REST API routes
• Audit WordPress plugin lists regularly for unexpected or unauthorized plugins

Monitoring Recommendations

• Enable detailed WordPress REST API logging to capture authentication failures and unusual endpoint access patterns
• Configure alerts for new plugin installations that occur outside of scheduled maintenance windows
• Deploy network-based monitoring to detect large numbers of requests to WordPress REST API endpoints
• Implement behavioral analysis to identify automated exploitation attempts against WordPress installations

How to Mitigate CVE-2024-11972

Immediate Actions Required

• Update Hunk Companion plugin to version 1.9.0 or later immediately
• Review installed plugins for any unauthorized additions and remove suspicious plugins
• Check WordPress user accounts for any unauthorized administrator accounts that may have been created through chained exploits
• Enable a web application firewall (WAF) with WordPress-specific rules to block malicious REST API requests

Patch Information

The vulnerability has been addressed in Hunk Companion version 1.9.0. Site administrators should update to this version or later through the WordPress admin dashboard or via WP-CLI. For detailed vulnerability information, refer to the WPScan Vulnerability Report.

Workarounds

• If immediate patching is not possible, disable the Hunk Companion plugin until the update can be applied
• Implement IP-based access controls to restrict REST API access to trusted networks only
• Use a WordPress security plugin to enforce additional authentication on REST API endpoints
• Consider temporarily blocking requests to /wp-json/ routes related to Hunk Companion functionality through server configuration

# Example: Block Hunk Companion REST API endpoints via .htaccess (temporary workaround)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/hunk-companion/ [NC]
    RewriteRule .* - [F,L]
</IfModule>