CVE-2024-9707

CRITICAL EXPLOITED NUCLEI

Hunk Companion <= 1.8.4 - Unauthenticated Arbitrary Plugin Installation and Activation via REST API

Title source: llm

Exploitation Summary

CVE-2024-9707 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including iSee857, RandomRobbieBF, Boshe99. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains functional exploit code for CVE-2024-9707, demonstrating a command execution vulnerability in OpenCode. The script includes a multi-threaded scanner that checks for the vulnerability by creating a session and executing a command (e.g., 'id') to verify RCE.

Description

The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

Exploits (4)

github WORKING POC 40 stars

by iSee857 · pythonpoc

https://github.com/iSee857/CVE-PoC/tree/main/WordPress_Hunk_Companion(CVE-2024-9707).py

View Code ZIP pw:eip

The repository contains functional exploit code for CVE-2024-9707, demonstrating a command execution vulnerability in OpenCode. The script includes a multi-threaded scanner that checks for the vulnerability by creating a session and executing a command (e.g., 'id') to verify RCE.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: OpenCode (version not specified)

No auth needed

Prerequisites: Network access to the target · OpenCode service running

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 27, 2026 Full analysis →

nomisec WORKING POC 1 stars

by RandomRobbieBF · remote

https://github.com/RandomRobbieBF/CVE-2024-9707

View Code ZIP pw:eip

This PoC demonstrates an unauthenticated arbitrary plugin installation/activation vulnerability in Hunk Companion <= 1.8.4 via a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint. The provided HTTP request can be used to install and activate arbitrary plugins, potentially leading to remote code execution if a vulnerable plugin is installed.

Classification

Working Poc 95%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: Hunk Companion WordPress plugin <= 1.8.4

No auth needed

Prerequisites: Access to the target WordPress site's REST API endpoint · Network connectivity to the target site

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

github WORKING POC

by Boshe99 · pythonpoc

https://github.com/Boshe99/CVE-Exploits/tree/main/CVE-2024-9707-Poc

View Code ZIP pw:eip

The repository contains functional exploit code for CVE-2024-9707, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: WordPress Plugin 3DPrint Lite 1.9.1.4

No auth needed

Prerequisites: target URL · path to a file to upload

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 27, 2026 Full analysis →

nomisec WORKING POC

by Nxploited · remote

https://github.com/Nxploited/CVE-2024-9707-Poc

View Code ZIP pw:eip

This PoC exploits CVE-2024-9707, a missing authorization vulnerability in the WordPress Hunk Companion plugin (<= 1.8.4), allowing unauthenticated arbitrary plugin installation/activation via the REST API endpoint /wp-json/hc/v1/themehunk-import.

Classification

Working Poc 95%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: WordPress Hunk Companion plugin <= 1.8.4

No auth needed

Prerequisites: Python 3.x · requests library · target WordPress site with vulnerable Hunk Companion plugin

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Hunk Companion <= 1.8.4 - Arbitrary Plugin Installation

CRITICALVERIFIEDby DhiyaneshDK

FOFA: body="/wp-content/plugins/hunk-companion/"

References (4)

Core 4

Core References

Product

https://github.com/WordPressBugBounty/plugins-hunk-companion/blob/5a3cedc7b3d35d407b210e691c53c6cb400e4051/hunk-companion/import/app/app.php#L46

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3166501%40hunk-companion&new=3166501%40hunk-companion&sfp_email=&sfph_mail=

Product

https://wordpress.org/plugins/hunk-companion/

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/9c101fca-037c-4bed-9dc7-baa021a8b59c?source=cve

Scores

CVSS v3 9.8

EPSS 0.0914

EPSS Percentile 94.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

VulnCheck KEV 2024-10-11

CWE

CWE-862

Status published

Products (2)

themehunk/Hunk Companion < 1.8.4

themehunk/hunk_companion < 1.8.5

Published Oct 11, 2024

Tracked Since Feb 18, 2026