Unauthenticated Plugin Installation and Activation in Hunk Companion WordPress Plugin

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-11972, targeting the Hunk Companion WordPress plugin (versions below 1.9.0). The exploit is implemented in a single Python script, 'hunk_companion_exploit.py', which automates the process of exploiting an authentication bypass in the plugin's REST API endpoint '/wp-json/hc/v1/themehunk-import'. By sending a specially crafted POST request, an unauthenticated attacker can install and activate any plugin from the official WordPress plugin repository on the target site. The script requires the attacker to specify the target WordPress site's URL and the desired plugin's slug. The repository also includes a README.md with detailed usage instructions and a LICENSE file. No hardcoded IPs or domains are present; the endpoint is relative and must be combined with the attacker's chosen target URL. The exploit is a functional PoC and does not include advanced payloads or post-exploitation features.

This repository contains a Python proof-of-concept exploit (CVE-2024-11972.py) targeting the Hunk Companion WordPress plugin versions less than 1.9.0. The exploit leverages an unauthenticated REST API endpoint (/wp-json/hc/v1/themehunk-import) to install and activate arbitrary plugins from the WordPress.org repository on a vulnerable WordPress site. The script first checks the installed plugin version by fetching /wp-content/plugins/hunk-companion/readme.txt, then, if the version is vulnerable, sends a crafted POST request to the REST API endpoint to trigger the plugin installation. The repository also includes a README.md with usage instructions and a description of the vulnerability. The exploit is a network-based, unauthenticated attack and does not require prior access to the target site.

This repository contains a Python exploit (exploit.py) and a detailed README for CVE-2024-11972, a critical unauthenticated plugin installation vulnerability in the Hunk Companion WordPress plugin (versions < 1.9.0). The exploit works by sending a crafted POST request to the '/wp-json/hc/v1/themehunk-import' REST API endpoint, which, due to improper authorization checks in vulnerable versions, allows any user to install and activate arbitrary plugins from the WordPress.org repository. The exploit script first checks the installed version of the Hunk Companion plugin by fetching its readme.txt, then attempts exploitation if the version is vulnerable. The README provides a thorough breakdown of the vulnerability, including code snippets from the plugin's source and a comparison of security fixes across versions. The main attack vector is network-based, targeting the exposed REST API endpoint. The exploit enables attackers to install further malicious or vulnerable plugins, potentially leading to remote code execution, database compromise, or persistent backdoors. The repository is well-structured, with a single exploit script and comprehensive documentation.