Hackers Exploit WordPress Arbitrary Installation Vulnerabilities in the Wild

According to Wordfence, a renewed wave of mass exploitation is targeting two popular WordPress plugins, GutenKit and Hunk Companion, allowing unauthenticated attackers to install and activate malicious software and potentially seize control of sites. The affected plugins have more than 40,000 and 8,000 active installations respectively, and patches have been available for over a year. Attacks resumed on 8 October 2025, with administrators urged to update immediately.

The flaws arise from missing authorization checks in the plugins’ REST API endpoints, with GutenKit up to version 2.1.0 permitting uploads of malicious ZIP files via the install-active-plugin endpoint, and Hunk Companion up to 1.8.5 enabling exploitation through the themehunk-import endpoint to fetch vulnerable plugins such as wp-query-console, both carrying a CVSS score of 9.8.

Wordfence’s analysis notes widespread activity and a firewall that has blocked millions of attempts since September 2024, alongside indicators of compromise including specific API endpoints and suspicious IPs.