Critical Code Execution Vulnerability in WordPress - CVE-2024-31211
Summary
DEBIAN-CVE-2024-31211: WordPress is an open publishing platform for the Web. Affects wordpress versions < 6.4.2+dfsg1-1. Fixed in 6.4.2+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WordPress is a widely-used open-source content management system (CMS) that enables users to create and manage websites easily. It is known for its flexibility, extensive plugin ecosystem, and user-friendly interface. However, like any software, it can be susceptible to vulnerabilities that may compromise its security. This specific vulnerability, identified as CVE-2024-31211, affects WordPress versions prior to 6.4.0, allowing for potential code execution through the unserialization of instances of the WP_HTML_Token class.
Vulnerability Detail
The vulnerability arises from the unserialization process of the WP_HTML_Token class, which can lead to code execution via its __destruct() magic method. This flaw can be exploited by attackers to execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, or complete control over the affected WordPress installation. The issue was addressed in WordPress version 6.4.2, released on December 6th, 2023.
How To Fix
Minimum fixed version
6.4.2+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wordpressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate updating is not possible, consider disabling any plugins or themes that utilize the WP_HTML_Token class until the update can be applied. However, this is not a permanent solution and should be followed by an update as soon as feasible.
Conclusion
The CVE-2024-31211 vulnerability poses a significant risk to WordPress installations prior to version 6.4.0, allowing for potential code execution. It is crucial for users to update to the latest version to mitigate this risk and ensure the security of their websites. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for wordpress →
FAQ
CVE-2024-31211 is a critical vulnerability in WordPress that allows for code execution through the unserialization of the WP_HTML_Token class.
WordPress versions prior to 6.4.0 are affected by this vulnerability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update immediately, consider disabling any plugins or themes that utilize the WP_HTML_Token class as a temporary workaround.
Regularly update your WordPress installation, plugins, and themes to their latest versions, and monitor for vulnerabilities using tools like Vulert.
References
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
