Thousands of sites running WordPress remain unpatched against a critical security flaw in a widely used plugin that was being actively exploited in attacks that allow for unauthenticated execution of malicious code, security researchers said.

The vulnerability, tracked as CVE-2024-11972, is found in Hunk Companion, a plugin that runs on 10,000 sites that use the WordPress content management system. The vulnerability, which carries a severity rating of 9.8 out of a possible 10, was patched earlier this week. At the time this post went live on Ars, figures provided on the Hunk Companion page indicated that less than 12 percent of users had installed the patch, meaning nearly 9,000 sites could be next to be targeted.

Significant, multifaceted threat

“This vulnerability represents a significant and multifaceted threat, targeting sites that use both a ThemeHunk theme and the Hunk Companion plugin,” Daniel Rodriguez, a researcher with WordPress security firm WP Scan, wrote. “With over 10,000 active installations, this exposed thousands of websites to anonymous, unauthenticated attacks capable of severely compromising their integrity.”

Read full article

Comments

• The US gave Ukraine permission to strike Russia with US-provided long-range missiles.
• But the late hour on this decision limits the impact.
• Russia has used Western hesitancy and the time provided by delays to move many targets out of range.

President Joe Biden is letting Ukraine strike inside Russia with its long-range missiles as he rushes aid to Ukraine before President-elect Donald Trump takes office, but the move has come so late that warfare experts don't expect it to make a huge difference.

As the West debated, Russia was given time to prepare while Ukraine was left to fend off attacks with a hand tied behind its back. Even now, there are still some limitations.

George Barros, a Russia analyst at the Institute for the Study of War in the US, told Business Insider: "It's way too little, years late. It's been a truism that Ukraine has needed the capability to strike the Russian rear for many years at this point."

Targets moved

Ukraine used its MGM-140 Army Tactical Missile Systems, a Lockheed Martin weapon with a maximum range of about 190 miles, to hit Russia for the first time this month. It then followed with Storm Shadows. Damage was done, but this capability would have had more of an effect earlier in the war.

Matthew Savill, a former intelligence analyst at the UK Ministry of Defence who's now a military expert at the Royal United Services Institute, said that "many of the best targets— helicopters and glide-bomb-armed aircraft attacking Ukrainian cities and troops in the north or in Kursk— have largely moved to airbases outside the range of ATACMS."

Ukraine's military tried to strike those key targets, such as ammunition depots, airfields, and fighter-bombers, with its domestically produced long-range drones to curb Russian glide-bomb attacks, but missiles would have had a greater effect.

A senior Biden administration official told Politico in August that Russia had already moved 90% of the planes that launch glide bombs at Ukraine's civilian infrastructure out of ATACMS range. And a central European defense official told Reuters this month that Russia had moved many of its air assets out of range of Western weapons.

Michael Bohnert, a warfare expert at the RAND Corporation, told BI that Biden's change wasn't "too little, too late" but that "the delay will definitely limit the effectiveness of ATACMS strikes."

"Had Ukraine been able to destroy several squadrons of Su-34 and Su-35 fighters early in the year, then Russia would have significantly less capacity to employ glide bombs against Ukrainian positions and civilians," he said. Ukraine has been hit by thousands of guided glide bombs over the course of the year.

Earlier in the year, ISW had a map that identified nearly 250 potential ATACMS targets inside Russia. Many of those may no longer be viable targets.

A pattern of late aid

The US and other allies have been repeatedly criticized for slowness and hesitancy in giving Ukraine aid and permissions.

Soldiers in Ukraine have said Western aid coming in "tidbits" means they can't plan long-term, not knowing what will arrive and when. One American fighting in Ukraine told BI that "it feels like everything that we've been getting has been either too late or it's just enough to barely hold on."

Ukraine usually gets what it needs eventually, but rarely when it really needs it. And the weaponry, such as F-16s and advanced tanks, are often given in amounts so small that they can't make a substantial difference. Ukrainian President Volodymyr Zelenskyy has said as much, matching analyst assessments.

The head of NATO has also been critical of member countries, saying they could do more to help Ukraine. There's been a hesitancy that comes from a fear of escalation.

Barros argued that the "Russian red lines are part of Russian reflexive control efforts that seek to trick the US and partners into accommodating Russian interests and counter Russian aggression in wars Russia started."

He said that "Putin is not entitled to a veto over US or NATO policy on the basis that he can threaten us."

Hitting Russia

Biden's decision may be late, and the impact may be limited. But that doesn't mean there won't still be an effect.

Bohnert said that Ukraine could now use its Western weapons to try to "disrupt logistics and mobility of Russian and North Korean forces counterattacking in Kursk," giving Ukraine's forces more freedom of maneuver.

Ukraine advanced into Russia's Kursk region in August, where its military is now fighting Russian and North Korean troops.

Savill said that Biden's decision "still leaves plenty of opportunities to strike military headquarters and ammunition or supply locations supporting Russian and North Korean troops" but that "this would be a reduced impact from when the Ukrainians first requested these weapons."

A rush to help Ukraine

Biden has boosted support for Ukraine ahead of Trump's inauguration by rushing aid out, loosening restrictions, and offering greater financial support.

Trump hasn't announced a plan but has been critical of US aid to Ukraine. Some, including in Ukraine, are optimistic that Trump could end the war. But Trump has also hinted at seeking a peace deal, something that could try to push Ukraine to do things it doesn't want, such as giving territory to Russia.

Savill said of Biden's missile decision that "the impact may be more political, albeit with a narrowing window of opportunity."

He said Ukraine needed to "convince the incoming US administration that they are still worth backing — in President Trump's transactional view, a 'good investment,'" adding that "they will want to convince him to link his and US credibility to a 'winning' outcome, not a major compromise that sees the US 'lose.'"

Politically, "the signs are not positive on this front," he said, as big Trump allies have criticized the ATACMS move, especially after Russia signaled its discontent with an unusual new missile strike.

And realistically, the decision delays on the Biden administration's part have probably hindered Ukraine's ability to show strength for political gain, Savill said. "It is unlikely that the Ukrainians can have a major impact in such a short period of time (under two months) until the next administration is formally in place and with an uncertain but probably small stockpile of ATACMS," he said.

• Ukraine has long been restricted from using Western missiles to strike inside Russia.
• The US relaxed some of the rules over the weekend following North Korea's involvement in the war.
• Kyiv has since used both ATACMS and Storm Shadow missiles to hit targets on Russian soil.

Ukraine is finally using its powerful, longer-range Western missiles to strike targets inside Russia after waiting over a year for permission.

On Wednesday, Ukraine fired British-made Storm Shadow cruise missiles at targets inside Russia for the first time, according to several media outlets and local footage. The UK defense ministry and Kyiv did not immediately comment on the reported developments.

Ukraine fired a volley of at least 10 Storm Shadow missiles into Russia, The Wall Street Journal reported, citing Ukrainian and Western officials.

The Storm Shadow strikes come a day after Ukraine first fired US-made tactical ballistic missiles, known as ATACMS, at a military facility in Russia's western Bryansk region. Kyiv acknowledged the strike but did not say what weapons were used.

Ukraine had long been prohibited from using these Western missiles to strike inside Russia, but President Joe Biden authorized the use of ATACMS over the weekend in a major policy shift, and the UK seemed to follow suit with Storm Shadow. Both missiles have now been used in strikes on Russian soil.

The removal of the restrictions on weapons usage follows the introduction of North Korean troops in the war — a development that NATO has called a "significant escalation" — and comes at a critical moment in the grinding conflict, which just passed the 1,000-day mark.

What are these missiles?

ATACMS, or Army Tactical Missile Systems, are short-range missiles made by US defense contractor Lockheed Martin. They can be fired from Ukraine's M142 High Mobility Artillery Rocket System or M270 Multiple Launch Rocket System, which are mobile ground-based launchers.

ATACMS can hit targets up to 190 miles away and, depending on the variant, carry unitary warheads or cluster munitions, which disperse little bomblets mid-flight over a large area.

The longest-range ATACMS variant has a farther reach than much of Ukraine's arsenal, including the British air-launched Storm Shadow cruise missile, which can strike targets around 155 miles away. It's unclear how many ATACMS and Storm Shadows Kyiv has available in its arsenal.

The Storm Shadow is made by the European multinational corporation MBDA. The missile has low-observable features, can carry a nearly 1,000-pound warhead, and fly at low altitudes to avoid detection. Like Britain, France has also provided Ukraine with its version of the weapon, known as SCALP-EG.

Ukraine debuted its ATACMS and Storm Shadow missiles last year but has been limited to using them against targets in territory that Russia illegally occupies in the eastern and southern regions, including the Crimean peninsula.

Ukrainian officials, including President Volodymyr Zelenskyy, have repeatedly lobbied for all restrictions to be dropped, and analysts have said the limitations have hamstrung Kyiv's ability to effectively defend itself. The US opposed the move, fearing it could escalate the conflict.

In the face of these restrictions, Ukraine has relied on domestically produced attack drones and missiles to carry out long-range strikes on sensitive military targets in Russia. This campaign has escalated in recent months.

However, the recent involvement of North Korea in the war appears to have moved the needle for the White House. Thousands of North Korean troops have been sent to Russia's Kursk region to help Moscow expel Ukrainian forces, who continue to hold a small chunk of territory there following a surprise invasion in early August.

Biden's policy shift comes just weeks before President-elect Donald Trump takes office. The incoming commander-in-chief is skeptical of US support for Ukraine and could decide to reverse the order.

The Kremlin has warned the West against allowing Ukraine to use its missiles to strike Russian territory. On Tuesday, President Vladimir Putin approved an update to the country's nuclear doctrine in a move that seemed to directly respond to the ATACMS policy reversal.