CVE-2024-9707 is a critical missing authorization vulnerability (CWE-862) in the Hunk Companion plugin for WordPress. The vulnerability exists on the /wp-json/hc/v1/themehunk-import REST API endpoint, which lacks proper capability checks. This allows unauthenticated attackers to install and activate arbitrary plugins, potentially leading to remote code execution when combined with other vulnerable plugins. The issue affects all versions up to and including 1.8.4. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can exploit this vulnerability to install and activate arbitrary WordPress plugins on affected sites. This can lead to remote code execution if another vulnerable plugin is present and activated, severely compromising the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API endpoint if possible and monitor for suspicious plugin installations. Avoid installing or activating untrusted plugins and consider disabling the Hunk Companion plugin if feasible.