PT-2024-23740 · WordPress+1 · Woody Code Snippets – Insert Header Footer Code+1

Craig Smith + 1 · Published 2024-06-15 · Updated 2024-08-12 · CVE-2024-3105

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress versions up to, and including, 2.5.0

Description The issue allows for Remote Code Execution via the insert php shortcode due to the lack of restrictions on its usage to high-level authorized users. This enables authenticated attackers with contributor-level access and above to execute code on the server. It is estimated that over 70,000 WordPress sites are potentially affected.

Recommendations For versions up to, and including, 2.5.0, consider disabling the insert php shortcode until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to only high-level authorized users as a temporary mitigation measure.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-3105

Affected Products

Adsense Ads

Woody Code Snippets – Insert Header Footer Code

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-3105 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/134ad095-b0a0-4f0f-832d-3e558d4a250a?source=cve · Note
• https://t.me/pentestingnews/48152 · Telegram Post
• https://twitter.com/hanul93/status/1823090295602639189 · Twitter Post
• https://plugins.trac.wordpress.org/browser/insert-php/trunk/includes/shortcodes/shortcode-insert-php.php · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3102522%40insert-php&new=3102522%40insert-php&sfp_email=&sfph_mail= · Note
• https://t.me/thedarkwebinformer/2286 · Telegram Post
• https://plugins.trac.wordpress.org/browser/insert-php/trunk/includes/class.plugin.php#L166 · Note
• https://twitter.com/Komodosec/status/1810131741740552462 · Twitter Post