Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5tg3-ws9g-mqbm
Vulnerability ID VCID-5tg3-ws9g-mqbm
Aliases CVE-2024-31211
Summary WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-502 Deserialization of Untrusted Data
System Score Found at
epss 0.39711 https://api.first.org/data/v1/epss?cve=CVE-2024-31211
cvssv3.1 5.5 https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m257-q4m5-j653
ssvc Track https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m257-q4m5-j653
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-31211
GHSA-m257-q4m5-j653 https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m257-q4m5-j653
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m257-q4m5-j653
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-05T14:00:20Z/ Found at https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m257-q4m5-j653
Exploit Prediction Scoring System (EPSS)
Percentile 0.97382
EPSS Score 0.39711
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T17:17:09.212502+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0