Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: themehunk Component: Hunk Companion Clear all filters
TI-2024-11108 CVE-2024-11972 · GHSA-pp53-3m4v-vvmw

Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

Priority HIGH 83

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.59055 Published 2024-12-31 Fixed in 1.9.0
TI-2024-09004 CVE-2024-9707 · GHSA-8cm3-4qfx-pwvc

Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

Priority MEDIUM 60

The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and i…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.09078 Published 2024-10-11 No fix listed CWE-862