Do Son Wordfence warned of a massive RCE campaign (8.7M+ attacks) exploiting flaws in GutenKit/Hunk Companion plugins. Unauthenticated attackers can install malicious plugins via vulnerable REST API endpoints.
Hunk Companion
Uncover the severe WordPress vulnerability, CVE-2024-11972, allowing attackers to bypass permission checks and install plugins directly from the repository.