WordPress Arbitrary Installation Vulnerabilities Exploited in Mass Campaign

Wordfence reported renewed mass exploitation beginning October 8, 2025, targeting WordPress arbitrary installation vulnerabilities in GutenKit and Hunk Companion. These vulnerabilities can allow unauthenticated attackers to install and activate arbitrary plugins and can lead to remote code execution.

Its October 23, 2025 report recorded more than 8,755,000 blocked exploit attempts since the firewall rules were released. This is a count of blocked attempts, not confirmed compromises or distinct affected websites. Below is a technical overview of these WordPress arbitrary installation vulnerabilities and remediation guidance.

WordPress Arbitrary Installation Vulnerabilities: Attack Details & Methods

The plugins have different authorization failures. For Hunk Companion, WPScan documented that the attempted fix returned a truthy WP_REST_Response on failed checks rather than rejecting access with WP_Error or false. WPScan reproduced the issue on version 1.8.7 and confirmed the subsequent fix in 1.9.0.

GutenKit’s affected gutenkit/v1/install-active-plugin endpoint reaches the install_and_activate_plugin_from_external() function. Hunk Companion’s hc/v1/themehunk-import endpoint was used in the separate WordPress.org plugin-installation chain documented by WPScan.

GutenKit’s flaw permits unauthenticated arbitrary file upload through external plugin installation. In WPScan’s observed Hunk Companion chain, the attacker installed the vulnerable WP Query Console plugin from WordPress.org and then exploited that plugin to execute PHP. These should not be described as identical external ZIP-upload mechanisms.

Malicious Payloads and In-Memory Webshell Deployment

Once attackers trigger these WordPress arbitrary installation vulnerabilities, the deployed archives drop heavily obfuscated PHP backdoors disguised with legitimate metadata headers (such as All in One SEO or standard WordPress core labels) to evade static file scanners.

The malicious packages typically deploy:

• Base64-Encoded File Managers: Allow attackers to browse, edit, and exfiltrate database configuration files (wp-config.php) directly through the browser.
• Persistent Web Shells: Grant unauthenticated interactive command execution capabilities on the underlying operating system.
• Database Rogue Administrators: Inject hidden administrator accounts directly into the wp_users table with elevated capabilities.

To monitor active CMS exploits, zero-day CVEs, and enterprise vulnerability alerts, visit our 2026 Enterprise CVE & Vulnerabilities Security Hub.

Actionable Verification Commands for WordPress Administrators

System administrators and website owners should execute the following command checks across their server environments to audit for unauthorized plugin installations:

• List recently modified plugin files: find wp-content/plugins/ -type f -mtime -7
• Inspect WordPress users with administrator role via WP-CLI: wp user list --role=administrator
• Audit web server logs for exploitation attempts: grep -E "install-active-plugin|themehunk-import" /var/log/nginx/access.log
• Check for unexpected PHP files in upload directories: find wp-content/uploads/ -name "*.php"

Immediate Mitigation and Remediation Checklist

To neutralize the risk of compromise from these WordPress arbitrary installation vulnerabilities, implement the following security controls immediately:

• Update Plugins Instantly: Install current vendor-supported releases. Versions 2.1.1 for GutenKit and 1.9.0 for Hunk Companion are historical minimum fixes for the flaws discussed here, not assurance against later vulnerabilities.
• Audit Plugin Directories: Manually inspect wp-content/plugins and wp-content/upgrade for unknown or unverified plugin folders.
• Enforce Web Application Firewall (WAF) Rules: Configure your firewall to block unauthenticated external requests targeting /wp-json/gutenkit/v1/ and /wp-json/hc/v1/ endpoints.
• Disable File Editing in Dashboard: Add define('DISALLOW_FILE_EDIT', true); to your wp-config.php file to prevent attackers from editing theme and plugin files if an admin account is compromised.

Frequently Asked Questions (FAQ)

What are WordPress arbitrary installation vulnerabilities?

WordPress arbitrary installation vulnerabilities are high-severity security flaws that allow unauthenticated remote attackers to upload, install, and execute unauthorized plugins on a target website by exploiting missing authorization checks in REST API endpoints.

Which plugins are affected by this mass exploit campaign?

The mass campaign specifically targets GutenKit (version 2.1.0 and earlier) and Hunk Companion (versions earlier than 1.9.0), which collectively account for nearly 50,000 active WordPress installations.

How do hackers exploit the GutenKit and Hunk Companion plugins?

Attackers abuse missing or ineffective authorization on vulnerable installation endpoints. The documented Hunk Companion chain installs a vulnerable WordPress.org plugin and exploits it for code execution; GutenKit supports a distinct external-upload path.

How can website owners detect if their site was compromised?

Check the wp-content/plugins directory for unfamiliar folders, review administrator user accounts for unrecognized emails, and inspect server access logs for requests targeting install-active-plugin or themehunk-import.

This article summarizes published vulnerability research. The listed checks are initial triage steps and do not establish that a site is free of compromise.