The WP_HTML_Tag_Processor class in WordPress does not implement a __wakeup() method to prevent unserialization. This allows the class to be used as a gadget in a PHP Object Injection (PoP) chain attack. If an attacker can trigger unserialization of untrusted data (e.g. through a vulnerable plugin), the WP_HTML_Tag_Processor class could be exploited to execute arbitrary code. The fix adds a __wakeup() method that throws a LogicException, preventing the class from being unserialized.
This vulnerability affects the following application versions:
- WordPress 6.2
- WordPress 6.2.1
- WordPress 6.2.2
- WordPress 6.2.3
- WordPress 6.2.4
- WordPress 6.2.5
- WordPress 6.2.6
- WordPress 6.2.7
- WordPress 6.2.8
- WordPress 6.3
- WordPress 6.3.1
- WordPress 6.3.2
- WordPress 6.3.3
- WordPress 6.3.4
- WordPress 6.3.5
- WordPress 6.3.6
- WordPress 6.3.7
- WordPress 6.4
- WordPress 6.4.1
- WordPress 6.4.2
- WordPress 6.4.3
- WordPress 6.4.4
- WordPress 6.4.5
- WordPress 6.4.6
- WordPress 6.4.7
- WordPress 6.5
- WordPress 6.5.2
- WordPress 6.5.3
- WordPress 6.5.4
- WordPress 6.5.5
- WordPress 6.5.6
- WordPress 6.5.7
- WordPress 6.6
- WordPress 6.6.1
- WordPress 6.6.2
- WordPress 6.6.3
- WordPress 6.6.4
- WordPress 6.7
- WordPress 6.7.1
- WordPress 6.7.2
- WordPress 6.7.3
- WordPress 6.7.4
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.9
- WordPress 6.9.1