NewsPublished 27 Oct 2025

Wordfence blocks 8.7M attacks exploiting old GutenKit and Hunk Companion flaws

Source Reddit InfoSec News

Description

Wordfence has blocked approximately 8.7 million attacks exploiting vulnerabilities in the outdated GutenKit and Hunk Companion WordPress plugins. These flaws, although old, continue to be targeted by attackers attempting to compromise WordPress sites. The attacks are widespread but do not currently have known active exploits in the wild beyond these blocked attempts. The vulnerabilities allow attackers to potentially execute unauthorized actions on affected sites, risking data confidentiality and site integrity. European organizations using these plugins remain at risk if they have not removed or patched these components. Mitigation involves removing these outdated plugins, applying any available patches, and employing robust web application firewalls like Wordfence. Countries with high WordPress usage and significant e-commerce or media sectors are more likely to be targeted. Given the scale of attacks and potential impact, the threat severity is assessed as high. Defenders should prioritize identifying and remediating these vulnerable plugins to prevent compromise.

Impact

For European organizations, the impact of these attacks can be substantial, especially for those relying on WordPress for their web presence, e-commerce, or content management. Successful exploitation could lead to unauthorized data access, defacement, or the insertion of malicious code, damaging brand reputation and potentially violating data protection regulations such as GDPR. The high volume of attacks indicates persistent targeting, which could overwhelm security teams and lead to increased operational costs. Organizations in sectors with high online visibility or sensitive data, such as finance, healthcare, and media, are particularly at risk. Additionally, compromised sites can be used as launchpads for further attacks, increasing the threat landscape. The continued exploitation attempts highlight the risk posed by legacy or unmaintained software components, emphasizing the need for proactive vulnerability management.

Defensive guidance

European organizations should immediately audit their WordPress installations to identify any presence of the GutenKit and Hunk Companion plugins. If found, these plugins should be removed or updated to patched versions if available. Employing comprehensive web application firewalls (WAFs) like Wordfence can help detect and block exploitation attempts in real time. Regular vulnerability scanning and penetration testing should be conducted to identify other outdated or vulnerable plugins. Organizations should enforce strict plugin management policies, including disabling automatic plugin installations and restricting administrative access. Monitoring web server logs for unusual activity related to these plugins can provide early warning signs. Additionally, organizations should ensure that WordPress core and all plugins/themes are kept up to date. Incident response plans should be updated to include procedures for handling WordPress plugin exploitation. Finally, user education on the risks of outdated plugins and the importance of timely updates can reduce exposure.

Summary

The reported threat involves a large volume of attacks—approximately 8.7 million—targeting known vulnerabilities in the GutenKit and Hunk Companion WordPress plugins. These plugins are outdated and contain security flaws that allow attackers to exploit them for unauthorized access or code execution on WordPress sites. Although these vulnerabilities are not new, attackers continue to scan and attempt exploitation due to the widespread use of these plugins and the potential for easy compromise on unpatched or unremoved installations. Wordfence, a popular WordPress security plugin, has been actively blocking these attack attempts, preventing successful exploitation thus far. The lack of known active exploits in the wild beyond these blocked attempts suggests that attackers are still probing for vulnerable targets. The vulnerabilities likely impact the confidentiality and integrity of affected sites by enabling unauthorized actions, potentially leading to data theft, site defacement, or further malware deployment. The attacks do not require user interaction but target publicly accessible WordPress sites with these plugins installed. No CVSS score is provided, but the volume and nature of attacks indicate a significant threat. The technical details are limited, but the threat underscores the importance of removing deprecated plugins and maintaining updated security controls on WordPress environments.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Oct 2025, 10:44 UTC

Technical details

References

Community reviews

Related threats