CVE-2024-31211
Remote Code Execution in `WP_HTML_Token`
Summary
Remote Code Execution in WP_HTML_Token
Original description
The description as published by the source.
WordPress is an open publishing platform for the Web. Unserialization of instances of the WP_HTML_Token class allows for code execution via its __destruct() magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
wordpress-multisite
[{"type":"SEMVER","events":[{"introduced":"6.4.0"},{"fixed":"6.4.2"}]}]
Bitnami
wordpress
[{"type":"SEMVER","events":[{"introduced":"6.4.0"},{"fixed":"6.4.2"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-31211 wordpress Fixed in: 6.4.2+dfsg1-1
References
- advisory github.com
- web nvd.nist.gov