Unauthorized Plugin Installation in Hunk Companion: A Critical WordPress Vulnerability

A newly disclosed vulnerability in the Hunk Companion plugin (< v1.9.0) has brought to light a significant security risk for WordPress sites. This flaw allows unauthenticated attackers to install and activate plugins directly from the WordPress.org repository, including outdated and vulnerable ones. Such plugins could be exploited for Remote Code Execution (RCE), SQL Injection, and other attacks, jeopardizing site security and user data.

In this article, we explore the implications of this vulnerability, the method of exploitation, and actionable measures to prevent such threats in the future.

In-Depth Analysis of the Vulnerability

Overview

The vulnerability in the Hunk Companion plugin was traced back to a flaw in its REST API endpoint (themehunk-import). This endpoint mishandled permission callbacks, allowing unauthenticated POST requests to install and activate arbitrary plugins. Exploiting this flaw, attackers could install a now-removed vulnerable plugin, WP Query Console, which contains an RCE vulnerability (CVE‑2024‑50498).

Impact

• Scope: Affects Hunk Companion versions below 1.9.0, with over 10,000 active installations worldwide.
• Exploitation Chain: Attackers use the Hunk Companion vulnerability to install WP Query Console, then exploit its RCE flaw to execute malicious code.
• Damage Potential: Enables attackers to compromise the website fully, write backdoors, execute arbitrary PHP code, and manipulate databases.

Steps to Exploitation

1. Unauthorized Installation: The attacker exploits the themehunk-import endpoint to install WP Query Console.
2. Remote Code Execution: Using the RCE flaw in WP Query Console, the attacker writes a PHP dropper to the site’s root directory.
3. Backdoor Creation: The PHP dropper facilitates persistent uploads, giving attackers continued unauthorized access.

Key Indicators of Exploitation

• Requests to suspicious endpoints (/wp-json/hc/v1/themehunk-import) in server logs.
• Changes to files in the root directory, such as randomly named PHP scripts.
• Unexpected plugin activations or installations.

10 Security Tips to Prevent Such Threats

1. Update Plugins Regularly: Always update plugins to the latest version to patch known vulnerabilities.
2. Audit Installed Plugins: Periodically review all installed plugins and remove those that are outdated, unused, or unsupported.
3. Restrict REST API Access: Limit access to REST API endpoints and use robust permission callbacks.
4. Implement Web Application Firewalls (WAF): Block suspicious POST requests targeting known endpoints.
5. Monitor Logs: Analyze server logs for unusual activity, especially relating to file modifications or unexpected API calls.
6. Enable Two-Factor Authentication (2FA): Add an extra layer of security to administrative accounts.
7. Use Verified Plugins: Install plugins only from trusted and verified sources. Avoid using plugins that have been removed or flagged by WordPress.org.
8. Implement Least Privilege Principles: Ensure users have the minimum permissions required to perform their tasks.
9. Conduct Regular Security Scans: Use tools like Wordfence or Sucuri to identify vulnerabilities in real-time.
10. Backup Regularly: Maintain up-to-date backups to restore your site quickly in case of an attack.

Conclusion

The Hunk Companion vulnerability underscores the critical importance of secure plugin development and diligent maintenance. As WordPress remains a target for cyberattacks due to its widespread usage, vulnerabilities like this serve as a wake-up call for developers and site administrators alike.

Organizations must adopt a proactive stance, combining regular updates, monitoring, and robust security practices to safeguard their websites against evolving threats.

Want to stay on top of cybersecurity news? Follow us on Facebook, X (Twitter), Instagram, and LinkedIn for the latest threats, insights, and updates!