CVE-2024-31211

WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.

• CWE-502

• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m257-q4m5-j653Vendor Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m257-q4m5-j653Vendor Advisory

Published

Apr 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31206dectalk-tts is a Node package to interact with the aeiou Dec…8.2
• CVE-2024-31207Vite (French word for "quick", pronounced /vit/, like "veet"…5.9
• CVE-2024-31208Synapse is an open-source Matrix homeserver. A remote Matrix…6.5
• CVE-2024-31209oidcc is the OpenID Connect client library for Erlang. Denia…5.3
• CVE-2024-3121A remote code execution vulnerability exists in the create_c…3.3
• CVE-2024-31210WordPress is an open publishing platform for the Web. It's p…8.8
• CVE-2024-31212InstantCMS is a free and open source content management syst…7.2
• CVE-2024-31213InstantCMS is a free and open source content management syst…5.4
• CVE-2024-31214Traccar is an open source GPS tracking system. Traccar versi…9.6
• CVE-2024-31215Mobile Security Framework (MobSF) is a security research pla…4.3
• CVE-2024-31216The source-controller is a Kubernetes operator, specialised …5.1
• CVE-2024-31217Strapi is an open-source content management system. Prior to…6.5