A critical vulnerability in the Hunk Companion plugin for WordPress is being actively exploited by attackers to install and activate outdated or vulnerable plugins, exposing websites to severe threats such as remote code execution (RCE), SQL Injection, cross-site scripting (XSS), and the creation of backdoor admin accounts. Affecting versions prior to 1.9.0, this flaw, tracked as CVE-2024-11972 (CVSS 9.8/10), allows unauthenticated POST requests to bypass permission checks and install plugins, including the abandoned WP Query Console plugin, which contains an unpatched zero-day RCE flaw (CVE-2024-50498, CVSS 10/10). Threat actors use this exploit to execute malicious PHP code, tamper with site files, and maintain persistent access through PHP droppers. WPScan discovered the vulnerability while investigating a WordPress site infection and noted that the flaw is a patch bypass for a similar vulnerability fixed inadequately in version 1.8.5. Although a security update was released in version 1.9.0, over 8,000 sites remain unprotected, highlighting the urgency for users to update immediately. This chain of exploitation underscores the critical importance of securing all WordPress components, especially third-party plugins, which are frequently targeted as entry points by attackers. CTIX analysts recommend that all affected site administrators who have yet to install the patch do so immediately to prevent future exploitation.