A widespread exploitation campaign is targeting WordPress websites with GutenKit and Hunk Companion plugins vulnerable to critical-severity, old security issues that can be used to achieve remote code execution (RCE).

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

A widespread exploitation campaign is targeting WordPress websites with GutenKit and Hunk Companion plugins vulnerable to critical-severity, old security issues that can be used to achieve remote code...

Hackers exploited old RCE flaws in WordPress GutenKit and Hunk Companion plugins. Wordfence firm blocked 8.7M attacks in two days.

A wave of attacks is currently targeting WordPress sites by exploiting critical vulnerabilities in two popular plugins, GutenKit and Hunk Companion. These vulnerabilities allow attackers to execute arbitrary code and gain full control over affected websites. The attacks were detected by Wordfence, a leading security firm specializing in WordPress protection. Users of these plugins are strongly advised to update immediately to mitigate the risk. Technical Context: WordPress is a widely used CMS, and its extensibility via plugins makes it a common target for attackers. GutenKit and Hunk Companion are plugins that add functionality to WordPress sites. The vulnerabilities in these plugins are severe, as they permit arbitrary code execution, which can lead to complete site compromise. Arbitrary code execution vulnerabilities are particularly dangerous because they allow attackers to perform any action on the server, including installing malware, stealing sensitive data, or using the site for further malicious activities. Implications: The impact of these vulnerabilities is significant due to the popularity of WordPress and its plugins. A large number of sites could be at risk if they are using vulnerable versions of GutenKit or Hunk Companion. The exploitation of such vulnerabilities can lead to widespread compromises, affecting not only the site owners but also their visitors, who may be exposed to malicious content or phishing attacks. Cybersecurity Landscape Impact: This incident highlights the ongoing threat posed by third-party components in web applications. Plugins and extensions are often the weakest link in the security chain, as they may not receive the same level of scrutiny as core software. The attacks also underscore the importance of proactive security measures, such as regular updates, vulnerability scanning, and the use of security monitoring tools like Wordfence. Expert Insights: For cybersecurity professionals, this incident serves as a reminder of the critical importance of patch management. Regularly updating software and plugins is one of the most effective ways to prevent exploitation. Additionally, it is advisable to conduct regular audits of installed plugins to ensure they are from reputable sources and are actively maintained. Investing in security monitoring tools can also provide an additional layer of defense by detecting and mitigating attacks in real-time. In conclusion, the ongoing attacks targeting WordPress sites via vulnerabilities in GutenKit and Hunk Companion plugins are a stark reminder of the ever-present risks in the digital landscape. Immediate action, such as updating the affected plugins, is crucial to mitigate the threat. Cybersecurity professionals should use this incident to reinforce the importance of robust security practices within their organizations.

A widespread exploitation campaign is targeting WordPress websites with GutenKit and Hunk Companion plugins vulnerable to critical-severity, old security issues that can be used to achieve remote code...

GutenKit Blocks Pro is a premium WordPress plugin that enhances your Gutenberg editor with advanced…

A widespread exploitation campaign is targeting WordPress websites with GutenKit and Hunk Companion plugins vulnerable to critical-severity, old security issues that can be used to achieve remote code execution (RCE). [...]

A widespread exploitation campaign is targeting WordPress websites with GutenKit and Hunk Companion plugins vulnerable to critical-severity, old security issues that can be used to achieve remote code execution (RCE). [...]

Experience the advanced features like mega menu, query builder, custom break points and more inside the block editor! Get Gutenkit— the ultimate Gutenberg plugin for WordPress.