Medium severity5.5NVD Advisory· Published Apr 4, 2024· Updated Jun 17, 2026

CVE-2024-31211

Description

WordPress is an open publishing platform for the Web. Unserialization of instances of the WP_HTML_Token class allows for code execution via its __destruct() magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/WordPressllm-fuzzy2 versions
<6.4.0+ 1 more
- (no CPE)range: <6.4.0
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*range: >=6.4.0,<6.4.2
Package: https://wordpress.org/plugins/wordpress
WordPress/Wordpress Developcpe-rescue
Range: >= 6.4.0 < 6.4.2
osv-coords2 versions
pkg:bitnami/wordpress-multisite pkg:bitnami/wordpress
>= 6.4.0, < 6.4.2+ 1 more
- (no CPE)range: >= 6.4.0, < 6.4.2
- (no CPE)range: >= 6.4.0, < 6.4.2

Patches

Vulnerability mechanics

References

github.com/WordPress/wordpress-develop/security/advisories/GHSA-m257-q4m5-j653nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000