Critical severity9.9NVD Advisory· Published Jun 15, 2024· Updated Apr 15, 2026
CVE-2024-3105
CVE-2024-3105
Description
The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized users. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=2.5.0
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/browser/insert-php/trunk/includes/class.plugin.phpnvd
- plugins.trac.wordpress.org/browser/insert-php/trunk/includes/shortcodes/shortcode-insert-php.phpnvd
- plugins.trac.wordpress.org/changesetnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/134ad095-b0a0-4f0f-832d-3e558d4a250anvd
News mentions
0No linked articles in our index yet.