CVE-2024-31211: Remote Code Execution in `WP_HTML_Token`
WordPress is an open publishing platform for the Web. Unserialization of instances of the WPHTMLToken class allows for code execution via its destruct() magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31211?
CVE-2024-31211 has a high severity due to its potential for code execution through the `__destruct()` magic method in the `WP_HTML_Token` class.
How do I fix CVE-2024-31211?
To fix CVE-2024-31211, update your WordPress installation to version 6.4.2 or later.
Which versions of WordPress are affected by CVE-2024-31211?
CVE-2024-31211 affects WordPress versions between 6.4.0 and 6.4.1.
What does the vulnerability CVE-2024-31211 exploit?
CVE-2024-31211 exploits the unserialization process in the `WP_HTML_Token` class, allowing for arbitrary code execution.
When was CVE-2024-31211 patched?
CVE-2024-31211 was patched in WordPress version 6.4.2, released on December 6th, 2023.