CVE-2023-5843
Ads by datafeedr.com <= 1.1.3 - Unauthenticated (Limited) Remote Code Execution
CVSS Score
9.0
EPSS Score
0.0%
EPSS Percentile
0th
The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.
| CWE | CWE-94 |
| Vendor | datafeedrcom |
| Product | ads by datafeedr.com |
| Published | Oct 30, 2023 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for datafeedrcom ads by datafeedr.com
Be the first to know when new critical vulnerabilities affecting datafeedrcom ads by datafeedr.com are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
datafeedrcom / Ads by datafeedr.com
0 ≤ 1.1.3
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/5412fd87-49bc-445c-8d16-443e38933d1e?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ads-by-datafeedrcom/tags/1.1.3/inc/dfads.class.php#L34 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/2991088/ads-by-datafeedrcom
Credits
István Márton