WordPress Sites Under Siege by Old Critical Flaws

Summary

A massive exploitation campaign is actively targeting WordPress websites running outdated versions of the GutenKit and Hunk Companion plugins. Attackers are exploiting three critical vulnerabilities — CVE-2024-9234, CVE-2024-9707, and CVE-2024-11972 — that enable unauthenticated remote code execution, malicious plugin installation, and complete website takeover.

The campaign, which surged in October 2025, demonstrates how year-old unpatched vulnerabilities continue to endanger WordPress users globally. Threat actors are abusing unauthenticated REST API endpoints to upload weaponized plugins, establish persistent admin access, and exfiltrate data.

Weaponized payloads hosted on GitHub enable attackers to execute arbitrary code, delete files, or create fake administrator accounts. Even when full administrative access isn’t achieved, fallback exploitation techniques using vulnerable plugins like wp-query-console provide unauthenticated RCE (Remote Code Execution) capabilities.

This campaign underscores the importance of timely patching, plugin hygiene, and proactive threat monitoring across WordPress environments.

Vulnerability Details

CVE Overview

Technical Breakdown

Attackers exploit the install/activate routines of these plugins to bypass capability checks and gain unauthorized plugin-level control.

1. CVE-2024-9234 – GutenKit File Upload Exploit:
   Allows unauthenticated attackers to upload arbitrary files to the WordPress environment, potentially enabling RCE (Remote Code Execution).
2. CVE-2024-9707 and CVE-2024-11972 – Hunk Companion REST API Exploits:
   These vulnerabilities allow unauthorized plugin installation and activation through the endpoint /wp-json/hc/v1/themehunk-import.
   Attackers send crafted POST requests embedding malicious plugin objects that reference weaponized ZIP archives hosted on GitHub.

   One such ZIP archive, titled “up.zip,” contains obfuscated PHP scripts that can:

   • Upload or delete files.
   • Change file permissions.
   • Deploy password-protected scripts disguised as legitimate SEO plugins to silently grant admin access.
3. Fallback Exploitation:
   When direct admin creation fails, attackers deploy wp-query-console, a known vulnerable plugin, to gain unauthenticated RCE on targeted sites.

Affected Products

• GutenKit Plugin – Versions prior to 2.1.1
• Hunk Companion Plugin – Versions prior to 1.9.0
• Platforms Affected: All WordPress environments using the above vulnerable plugins

Exploitation Timeline

• First Observed: September 25, 2024
• Mass Exploitation Campaign: October 8–9, 2025
• Status: Active exploitation with publicly available PoC (Proof-of-Concept)

Recommendations

1. Update Vulnerable Plugins Immediately
   • Upgrade GutenKit to version 2.1.1.
   • Upgrade Hunk Companion to version 1.9.0.
   • Regularly verify all plugin and theme versions to ensure alignment with vendor-released security patches.
2. Remove Unused or Abandoned Plugins
   Eliminate inactive plugins to minimize the potential attack surface. Attackers often exploit outdated or unmaintained extensions to establish persistence.
3. Review Server and Access Logs
   Inspect logs for suspicious POST requests to /wp-json/hc/v1/themehunk-import and similar endpoints.
   • Look for references to up.zip, oke.zip, or other unfamiliar plugin ZIP uploads.
4. Audit User and Plugin Activity
   • Scan for unexpected administrator accounts.
   • Review recently added plugins or unfamiliar directory paths (e.g., /wp-content/plugins/up/).
5. Enhance Access Controls
   • Enforce Multi-Factor Authentication (MFA) for all admin accounts.
   • Restrict plugin installation and file modification permissions to trusted users only.
6. Implement Vulnerability Management Practices
   Maintain a centralized software inventory, apply patches promptly, and continuously monitor for newly disclosed WordPress plugin vulnerabilities.

Indicators of Compromise (IoCs)

IPv4 Addresses:
13[.]218[.]47[.]110, 3[.]10[.]141[.]23, 52[.]56[.]47[.]51, 18[.]219[.]237[.]98, 18[.]116[.]40[.]45,
119[.]34[.]179[.]21, 194[.]87[.]29[.]184, 3[.]133[.]135[.]47, 3[.]141[.]28[.]47, 3[.]85[.]107[.]39,
3[.]148[.]175[.]195, 193[.]84[.]71[.]244, 3[.]147[.]6[.]140, 3[.]144[.]26[.]200, 193[.]233[.]134[.]136

IPv6 Addresses:
2600[:]1f16[:]234[:]9300[:]70c6[:]9e26[:]de1a[:]7696,
2600[:]1f16[:]234[:]9300[:]f71[:]bed2[:]11e5[:]4080

Domains:
ls.fatec[.]info, dari-slideshow[.]ru, zarjavelli[.]ru, korobushkin[.]ru, drschischka[.]at,
dpaxt[.]io, cta.imasync[.]com, catbox[.]moe

Malicious Plugin Directories and ZIPs:

• /up/up.zip
• /background-image-cropper/background-image-cropper.zip
• /ultra-seo-processor-wp/ultra-seo-processor-wp.zip
• /oke/oke.zip

• /wp-query-console

MITRE ATT&CK TTPs

References

• Wordfence – Mass Exploit Campaign Targeting Arbitrary Plugin Installation Vulnerabilities
• WordPress GutenKit Plugin

• WordPress Hunk Companion Plugin