Critical WordPress RCE Flaws Resurface: Over 8.7 Million Attacks Exploit GutenKit & Hunk Companion

The Wordfence Threat Intelligence team has warned that large-scale attacks are resurfacing against three critical WordPress plugin vulnerabilities in GutenKit and Hunk Companion, CVE-2024-9234, CVE-2024-9707, and CVE-2024-11972, each with a CVSS score of 9.8. Wordfence reported that attackers began mass exploiting the issues again on 8 October 2025, about a year after the initial surge.

Wordfence has observed over 8,755,000 exploit attempts targeting these vulnerabilities, with a surge linked to a botnet of compromised servers and cloud instances driving automated exploitation worldwide. The flaws allow unauthenticated attackers to install and activate arbitrary plugins via insecure REST API endpoints, potentially enabling remote code execution.

GutenKit and Hunk Companion have a combined presence of tens of thousands of active installs, and the vulnerabilities affect endpoints such as /wp-json/gutenkit/v1/install-active-plugin and /wp-json/hc/v1/themehunk-import. Wordfence advises WordPress administrators to update GutenKit to ≥ 2.1.1 and Hunk Companion to ≥ 1.9.0, and to review plugin directories and access logs for suspicious activity.