HUNK COMPANION WORDPRESS PLUGIN EXPLOITED TO INSTALL VULNERABLE PLUGINS

Summary from the TLDR InfoSec newsletter

Researchers from WPScan have discovered a remote code execution vulnerability in the WordPress plugin Hunk Companion. Hunk Companion is used to complement the features provided by ThemeHunk which is a plugin designed to install new themes. The vulnerability allows for the installation of plugins via an unauthenticated POST request. Attackers have been actively exploiting this vulnerability to install PHP droppers which allow for maintaining persistent access.