CVE-2024-31211

MEDIUM

WordPress 6.4.0-6.4.1 - Remote Code Execution via WP_HTML_Token Unserialization

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-31211. PoCs published by Abdurahmon3236.

AI-analyzed exploit summary This repository contains a functional Metasploit module that exploits a PHP unserialization vulnerability in WordPress via the `WP_HTML_Token` class, leading to remote code execution (RCE). The exploit crafts a serialized payload targeting the `__destruct()` magic method and sends it via a POST request to `wp-login.php`.

Description

WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.

Exploits (1)

nomisec WORKING POC
by Abdurahmon3236 · poc
https://github.com/Abdurahmon3236/-CVE-2024-31211

This repository contains a functional Metasploit module that exploits a PHP unserialization vulnerability in WordPress via the `WP_HTML_Token` class, leading to remote code execution (RCE). The exploit crafts a serialized payload targeting the `__destruct()` magic method and sends it via a POST request to `wp-login.php`.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WordPress (versions not specified, but likely <= 5.x)
No auth needed
Prerequisites: Vulnerable WordPress installation · Network access to the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 5.5
EPSS 0.0274
EPSS Percentile 84.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-502
Status published
Products (1)
wordpress/wordpress 6.4.0 - 6.4.2
Published Apr 04, 2024
Tracked Since Feb 18, 2026