CVE-2024-31211

What it actually does

Unserialization of WP_HTML_Token instances invokes arbitrary code execution through the class __destruct() magic method.

Why it matters to the business

Administrators could gain the ability to run unauthorized code on the web server, enabling site takeover, data exposure, or defacement; the issue affects a widely deployed publishing platform with millions of installations.

How an attack unfolds

An attacker with administrative privileges crafts a malicious serialized WP_HTML_Token object, submits it through an entry point that triggers unserialization, and the destructor executes attacker-controlled code.

How to fix it

Upgrade WordPress to version 6.4.2 or newer. For git-based deployments apply commit 0730353098a9e36a319695d1f28c122361e4aef7 in wordpress/wordpress or ec3f364c491bac22e7479b00074c6b004bdd0592 in wordpress/wordpress-develop.

How to confirm the fix worked

Verify the installed WordPress core version is 6.4.2 or later; inspect source files for the presence of the referenced commit hashes or updated WP_HTML_Token destructor logic.

Typical attack path

1. Obtain high-privileged (administrator) access
2. Craft and inject a serialized WP_HTML_Token payload containing malicious code references
3. Trigger unserialization of the object via an affected code path
4. Execute arbitrary code in the context of the web server process

How to detect it

Review web server and application logs for serialized object patterns containing WP_HTML_Token references, unexpected destructor activity, or PHP unserialize errors around administrative actions.

What your security team should do

• Immediately upgrade all WordPress instances to 6.4.2 or newer
• Audit administrative accounts and limit unnecessary high-privilege access
• Enable application logging for unserialize operations and review for anomalies
• Monitor EPSS and exploit maturity indicators for any future changes