CVE-2024-31211: 
WordPress vulnerability analysis and mitigation

WordPress versions 6.4.0 through 6.4.1 are affected by a vulnerability (CVE-2024-31211) involving the unserialization of instances of the WP_HTML_Token class. The vulnerability was discovered and fixed in WordPress 6.4.2, released on December 6th, 2023. Notably, versions prior to 6.4.0 are not affected by this vulnerability (GitHub Advisory).

The vulnerability stems from the unserialization of instances of the WP_HTML_Token class, which allows for code execution via its __destruct() magic method. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, indicating it requires high privileges but can be exploited over the network with low attack complexity (GitHub Advisory).

The vulnerability can lead to remote code execution, potentially allowing attackers to execute arbitrary code on affected WordPress installations. The CVSS metrics indicate low impacts on both confidentiality and integrity, with no impact on availability (GitHub Advisory).

The vulnerability was publicly disclosed as a zero-day vulnerability without prior responsible disclosure to the WordPress security team. It requires high privileges to exploit but can be accessed over the network with low attack complexity (GitHub Advisory).

The vulnerability has been patched in WordPress version 6.4.2, released on December 6th, 2023. Users are advised to upgrade to this version or later to mitigate the risk. Users running versions prior to 6.4.0 are not affected by this vulnerability (GitHub Advisory).