Year-Old WordPress Plugin Flaws Exploited to Hack Websites

According to Defiant, three critical-severity vulnerabilities in the GutenKit and Hunk Companion WordPress plugins have been exploited in a new campaign. The flaws include CVE-2024-9234 in GutenKit versions prior to 2.1.1, and two issues in Hunk Companion versions prior to 1.8.4 and 1.8.5 that allow unauthorised plugin installation/activation via the themehunk-import REST API endpoint, tracked as CVE-2024-9707 and CVE-2024-11972.

Mass exploitation started on 8 October, with roughly 9 million exploit attempts observed this month as the campaign recommenced, notes the security firm. The attackers distribute a malicious ZIP file posing as a plugin, hosted on GitHub, containing scripts that act as backdoors and aim to establish persistence, including one that logs in as administrators.

Additional scripts change file permissions, enable download and viewing of files, and archive folders into ZIP files, while other payloads enable mass defacement, network sniffing and remote code execution to deploy further payloads. GutenKit and Hunk Companion currently have over 40,000 and 8,000 active installations, respectively, and administrators are advised to update to patched versions and review IOCs shared by Defiant.