WordPress 6.4.2 Update Fixes Critical Remote Attack Vulnerability
WordPress has released version 6.4.2 to address a critical security flaw that could allow threat actors to execute arbitrary PHP code on vulnerable sites. The vulnerability, which is not directly exploitable in core, can be combined with another bug to potentially achieve high severity, especially in multisite installations. The issue is rooted in the WP_HTML_Token class introduced in version 6.4. Users are advised to update their sites and developers are recommended to replace function calls to the unserialize function with alternatives like JSON encoding/decoding.
