CVE-2024-31211: Remote Code Execution in `WP_HTML_Token`
WordPress is an open publishing platform for the Web. Unserialization of instances of the WPHTMLToken class allows for code execution via its destruct() magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 6.4.2+dfsg1-1 - Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 6.1.9+dfsg1-0+deb12u1Fixed in 6.8.7+dfsg1-0+deb13u1Fixed in 6.8.12+dfsg1-0+deb13u1Fixed in 7.1.4+dfsg1-1 - Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 6.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31211?
CVE-2024-31211 has a high severity due to its potential for code execution through the `__destruct()` magic method in the `WP_HTML_Token` class.
How do I fix CVE-2024-31211?
To fix CVE-2024-31211, update your WordPress installation to version 6.4.2 or later.
Which versions of WordPress are affected by CVE-2024-31211?
CVE-2024-31211 affects WordPress versions between 6.4.0 and 6.4.1.
What does the vulnerability CVE-2024-31211 exploit?
CVE-2024-31211 exploits the unserialization process in the `WP_HTML_Token` class, allowing for arbitrary code execution.
When was CVE-2024-31211 patched?
CVE-2024-31211 was patched in WordPress version 6.4.2, released on December 6th, 2023.