
- Researchers from WPScan find flaw in Hunk Companion, a plugin with roughly 10,000 users
- The flaw allows crooks to install other plugins from the WP repository, including those with known RCE flaws
- WPScan found the flaw while investigating an active attack