Description
WordPress的Hunk Companion插件是一款用于创建完整web网站的工具。在 <=1.8.4 版本当中，由于在/wp-json/hc/v1/themehunk-import RESTAPI接口处缺乏能力检查，存在未经授权的插件安装/激活漏洞。这使得未认证的攻击者能够安装和激活任意插件，如果系统中已安装并激活了其他存在漏洞的插件，攻击者可以利用这些插件实现远程代码执行。
WordPress Hunk Companion 插件存在未认证漏洞（CVE-2024-9707）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-9707
https://www.wordfence.com/threat-intel/vulnerabilities/id/9c101fca-037c-4bed-9dc7-baa021a8b59c?source=cve
https://github.com/Nxploited/CVE-2024-9707-Poc
https://wordpress.org/plugins/hunk-companion/
https://cve.imfht.com/detail/CVE-2024-9707
https://pentest-tools.com/vulnerabilities-exploits/hunk-companion-184-arbitrary-plugin-installation_27174
https://access.redhat.com/security/cve/cve-2024-9707