CVE-2024-31211
Published: 04 April 2024
Summary
CVE-2024-31211 is a medium-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress Wordpress. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
WordPress contains a deserialization vulnerability in the WP_HTML_Token class that permits code execution through its __destruct magic method when untrusted instances are unserialized. The flaw affects WordPress versions 6.4.0 and 6.4.1; versions before 6.4.0 are unaffected, and the issue was resolved in the 6.4.2 release published on 6 December 2023. The weakness is tracked as CWE-502 and carries a CVSS 3.1 score of 5.5.
An attacker with high privileges can supply a malicious serialized WP_HTML_Token object over the network, triggering arbitrary code execution with limited confidentiality and integrity impact and a scope change. Exploitation therefore requires an authenticated user account possessing administrative or equivalent rights rather than unauthenticated or low-privileged access.
The official advisory published in the WordPress GitHub repository states that the fix is included in version 6.4.2 and recommends that sites running 6.4.0 or 6.4.1 update immediately. The current EPSS score of 0.3971, with a recorded peak of 0.4488, indicates moderate and slightly elevated exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29111
Vulnerability details
WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0…
more
are not affected.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.