Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-9707-Poc — he Hunk Companion Plugin for WordPress: Vulnerable to Unauthorized Plugin Installation/Activation (Versions Up to and Including 1.8.4) | Kitploit
Tools/GitHubGitHub/nxploited/cve-2024-9707-poc
Vulnerability AnalysisExploitationWeb Application ExploitationAPI Security TestingPenetration TestingLearning & Education
GitHubnxploited/cve-2024-9707-poc

CVE-2024-9707-Poc

he Hunk Companion Plugin for WordPress: Vulnerable to Unauthorized Plugin Installation/Activation (Versions Up to and Including 1.8.4)

View Repository
1 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-9707-Poc 🌐

Description

This script exploits the vulnerability in the WordPress Hunk Companion plugin (CVE-2024-9707), allowing unauthorized attackers to install and activate arbitrary plugins via the /wp-json/hc/v1/themehunk-import REST API endpoint.

Features

FeatureDescription
Plugin Version DetectionAutomatically checks the plugin version.
Vulnerability CheckDetermines if the detected version is vulnerable (<= 1.8.4).
Plugin InstallationExploits the vulnerability to install and activate a specified plugin.

🛠️ Installation and Usage:

Prerequisites

  • Python 3.x installed on your system.
  • Required Python libraries: requests, argparse.

Install the dependencies:

root@kitploit:~
pip install requests

Usage:

root@kitploit:~
options:
  -h, --help            show this help message and exit
  -u URL, --url URL     Base URL of the WordPress site.
  -p PLUGIN, --plugin PLUGIN
                        Plugin name (default: wp-file-manager).

2- Run the script

root@kitploit:~
python CVE-2024-9707.py -u <TARGET_URL> [-p <PLUGIN_NAME>]

Example:

root@kitploit:~
python CVE-2024-9707.py -u https://example.com -p wp-file-manager

Output

  • Version Detection: Displays the detected version of the Hunk Companion plugin.
  • Vulnerability Status: Informs whether the target is vulnerable.
  • Exploit Status: Displays the result of the plugin installation attempt.

Successful Output

root@kitploit:~
Detected version: 1.8.4
The site is vulnerable. Proceeding with exploitation.
Plugin installed and activated successfully.
Response Status: 200
Response Body: "http:\/\/192.168.100.74\/wordpress"

🚫 Disclaimer

This script is for educational purposes only. Use it responsibly and only on systems you own or have explicit permission to test. The authors are not responsible for any misuse or damage caused by this tool. by: Khaled_alenazi | Nxploited

Download Tool