CVE-2024-31211: WordPress RCE Vulnerability via Deserialization

CVE-2024-31211 Overview

CVE-2024-31211 is an insecure deserialization vulnerability in WordPress, the widely-used open publishing platform for the Web. The vulnerability allows attackers to execute arbitrary code through the unserialization of instances of the WP_HTML_Token class via its __destruct() magic method. This critical flaw affects WordPress versions 6.4.0 through 6.4.1 and was patched in version 6.4.2 on December 6th, 2023.

Critical Impact

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on vulnerable WordPress installations, potentially leading to complete site compromise, data theft, malware distribution, or server takeover.

Affected Products

• WordPress versions 6.4.0 to 6.4.1
• WordPress installations with the WP_HTML_Token class present
• WordPress sites that have not applied the 6.4.2 security update

Discovery Timeline

• 2024-04-04 - CVE-2024-31211 published to NVD
• 2026-01-02 - Last updated in NVD database

Technical Details for CVE-2024-31211

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), a dangerous class of vulnerabilities that can lead to remote code execution. The flaw exists in WordPress's handling of serialized objects, specifically the WP_HTML_Token class introduced in WordPress 6.4.0 as part of the new HTML parsing functionality.

When user-controlled data is passed to PHP's unserialize() function, and that data contains a serialized WP_HTML_Token object, the class's __destruct() magic method is automatically invoked when the object is destroyed. Attackers can craft malicious serialized payloads that, when deserialized, trigger the destructor with attacker-controlled properties, leading to arbitrary code execution.

The vulnerability requires an existing gadget chain or injection point where attacker-supplied data can reach an unserialize() call. While WordPress core does not directly deserialize user input in most contexts, plugins, themes, or custom code that unsafely deserializes data could expose sites to this attack vector.

Root Cause

The root cause of CVE-2024-31211 is the implementation of the __destruct() magic method in the WP_HTML_Token class without proper safeguards against being used in an object injection attack. When PHP deserializes an object, it instantiates the class and populates its properties from the serialized data. Upon destruction of the object (either explicitly or when the script ends), the __destruct() method executes automatically. If this method performs dangerous operations using object properties that can be controlled by an attacker through the serialized payload, code execution becomes possible.

Attack Vector

The attack is network-based and requires no authentication or user interaction, making it particularly dangerous. The attacker must:

1. Identify an entry point where attacker-controlled data is passed to unserialize() in a vulnerable WordPress installation
2. Craft a malicious serialized payload containing a WP_HTML_Token object with properties set to achieve code execution
3. Submit the payload to the vulnerable endpoint
4. The deserialization process instantiates the malicious object, and upon destruction, the __destruct() method executes with attacker-controlled values

The exploitation mechanism leverages PHP Object Injection (POI) techniques, where the WP_HTML_Token class serves as a "gadget" that can be chained with other classes or used directly to achieve arbitrary code execution. For detailed technical information, refer to the WordPress Security Advisory on GitHub.

Detection Methods for CVE-2024-31211

Indicators of Compromise

• Unexpected serialized data in HTTP request parameters, POST bodies, or cookies containing WP_HTML_Token class references
• Anomalous PHP error logs showing deserialization failures or unexpected object instantiation
• Suspicious file system changes or new files created by the web server process
• Unexplained outbound network connections from the WordPress server
• Evidence of webshells or backdoor code in WordPress directories

Detection Strategies

• Monitor web application logs for requests containing serialized PHP objects (look for patterns like O:13:"WP_HTML_Token")
• Implement Web Application Firewall (WAF) rules to detect and block serialized object payloads in user input
• Deploy file integrity monitoring to detect unauthorized modifications to WordPress core files
• Use intrusion detection systems to identify anomalous behavior from web server processes
• Regularly scan WordPress installations for known malicious code patterns

Monitoring Recommendations

• Enable detailed PHP error logging and monitor for deserialization-related errors
• Implement real-time log analysis for web server access and error logs
• Deploy endpoint detection and response (EDR) solutions on WordPress hosting infrastructure
• Configure alerts for unusual process spawning from PHP or web server processes
• Monitor network traffic for command-and-control communication patterns

How to Mitigate CVE-2024-31211

Immediate Actions Required

• Update WordPress immediately to version 6.4.2 or later, which contains the security fix
• Audit all installed plugins and themes for unsafe use of unserialize() with user-controlled data
• Review server logs for evidence of exploitation attempts
• Implement a Web Application Firewall (WAF) with rules to block serialized object injection attempts
• Consider restricting PHP functions using disable_functions in php.ini to limit post-exploitation capabilities

Patch Information

WordPress released version 6.4.2 on December 6th, 2023, which addresses this vulnerability. The fix modifies the WP_HTML_Token class to prevent its exploitation in object injection attacks. Site administrators should update through the WordPress admin dashboard or by downloading the latest version from WordPress.org.

For additional details about the fix, see the WordPress Security Advisory.

Workarounds

• If immediate patching is not possible, consider temporarily disabling plugins that may deserialize user input
• Implement input validation at the web server level to reject requests containing serialized PHP objects
• Use PHP's allowed_classes option in unserialize() calls to restrict which classes can be instantiated
• Deploy additional security layers such as ModSecurity with OWASP Core Rule Set
• Isolate WordPress installations in containerized environments to limit the impact of potential compromise

# Check current WordPress version and update status
wp core version
wp core check-update

# Update WordPress to the latest secure version
wp core update

# Verify the update was successful
wp core version

# Scan for known vulnerabilities in plugins/themes
wp plugin list --fields=name,version,update
wp theme list --fields=name,version,update