How severe is CVE-2024-11972?

CVE-2024-11972 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-11972 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 55% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-11972?

CVE-2024-11972 affects Themehunk Hunk Companion. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-11972?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2024-11972 have an EU (EUVD) identifier?

Yes. CVE-2024-11972 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-34370.

When was CVE-2024-11972 published?

CVE-2024-11972 was published on 2024-12-31 and last updated on 2026-06-17.

CVE-2024-11972

CVE-2024-11972 is a critical-severity vulnerability in Themehunk Hunk Companion with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 55% places it in the 99th percentile, indicating an elevated likelihood of exploitation.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 55% (99th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-34370
Affected product: Themehunk Hunk Companion
Published: 2024-12-31
Last modified: 2026-06-17

Description

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.

Frequently asked questions

What is CVE-2024-11972?: The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
How severe is CVE-2024-11972?: CVE-2024-11972 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-11972 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 55% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-11972?: CVE-2024-11972 affects Themehunk Hunk Companion. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-11972?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-11972 have an EU (EUVD) identifier?: Yes. CVE-2024-11972 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-34370.
When was CVE-2024-11972 published?: CVE-2024-11972 was published on 2024-12-31 and last updated on 2026-06-17.

References

https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/

Affected products (1)

cpe:2.3:a:themehunk:hunk_companion:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Themehunk Hunk Companion

CVE-2024-9707 — Critical (CVSS 9.8): The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing…

All CVEs affecting Themehunk Hunk Companion →