Wordfence blocks 8.7M attacks exploiting old GutenKit and Hunk Companion flaws

Wordfence blocked 8.7 million attacks in two days against WordPress sites exploiting two outdated plugins, GutenKit and Hunk Companion, according to Wordfence. The flaws were disclosed in September and October 2024 as Arbitrary Plugin Installation vulnerabilities, with GutenKit having over 40,000 active installations and Hunk Companion around 8,000.

Researchers identify CVE-2024-9234 (unauthenticated REST-endpoint flaw in GutenKit) and CVE-2024-9707 and CVE-2024-11972 (missing-authorization flaws in Hunk Companion) as the cited issues, each with a CVSS score of 9.8. Code reviews show both plugins expose public REST endpoints, enabling unauthenticated plugin installs and potential remote code execution; attackers reportedly used GutenKit’s install-active-plugin to fetch a malicious ZIP from GitHub, containing backdoors and a heavily obfuscated vv.php payload.

Wordfence notes attacks resumed on 8–9 October 2025, and it advises admins to review logs for specific endpoints and to inspect various plugin-related folders for rogue files, while keeping plugins updated and ensuring Wordfence scans the relevant directories.