BIT-wordpress-2024-31211: Remote Code Execution in `WP_HTML_Token`

Q: Which WordPress versions are affected?

WordPress versions from 6.4.0 up to, but not including, 6.4.2 are affected. Versions earlier than 6.4.0 are not affected.

Q: What access does an attacker need to exploit this issue?

The supplied vector indicates that exploitation is network-accessible, requires low attack complexity, and does not require user interaction. However, it also requires high privileges.

Q: What should administrators do?

Update WordPress to version 6.4.2 or a later version. The issue was fixed in 6.4.2.

Published Apr 4, 2024

Updated

WordPress is an open publishing platform for the Web. Unserialization of instances of the WPHTMLToken class allows for code execution via its destruct() magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.

Affected Software

1 affected component

WordPress WordPress>=6.4.0<6.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress to a version that resolves this vulnerability.
Fixed in 6.4.2

Event History

Apr 4, 2024

CVE Published

via OSV·11:00 PM

Data Sourced

via OSV·11:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which WordPress versions are affected?

WordPress versions from 6.4.0 up to, but not including, 6.4.2 are affected. Versions earlier than 6.4.0 are not affected.

What access does an attacker need to exploit this issue?

The supplied vector indicates that exploitation is network-accessible, requires low attack complexity, and does not require user interaction. However, it also requires high privileges.

What should administrators do?

Update WordPress to version 6.4.2 or a later version. The issue was fixed in 6.4.2.

BIT-wordpress-2024-31211: Remote Code Execution in `WP_HTML_Token`

Affected Software

Remediation

Event History

Frequently Asked Questions

Which WordPress versions are affected?

What access does an attacker need to exploit this issue?

What should administrators do?

Company

Resources

Contact

Frequently Asked Questions

Which WordPress versions are affected?

What access does an attacker need to exploit this issue?

What should administrators do?