### [CVE-2024-31211](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31211)
![](https://img.shields.io/static/v1?label=Product&message=wordpress-develop&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3E%3D%206.4.0%20%3C%206.4.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-502%3A%20Deserialization%20of%20Untrusted%20Data&color=brighgreen)

### Description

WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/Abdurahmon3236/-CVE-2024-31211
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/tpcybersec/TP-VulnBox
- https://github.com/truocphan/TP-VulnBox