WordPress core
CVE-2024-31211
Remote Code Execution in `WP_HTML_Token`
- Severity
- Critical 9.8
- Published
- 3 Apr 2024
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 17 Oct 2026
- Fixed in
- 6.4.2
- Also known as
- GHSA-m257-q4m5-j653
- Sources
- NVD, WordPress
Description
WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.
Affected software
| Software | Affected versions |
|---|---|
WordPressWordPress core · cpe:a:wordpress:wordpress |
|
References
- NVD https://nvd.nist.gov/vuln/detail/CVE-2024-31211
- CVE.org https://www.cve.org/CVERecord?id=CVE-2024-31211
- GitHub Advisory Database https://github.com/advisories/GHSA-m257-q4m5-j653
- WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m257-q4m5-j653