CVE-2023-5843: RCE in Ads by datafeedr.com WordPress Plugin

The impact of CVE-2023-5843 is severe. Successful exploitation allows an attacker to execute arbitrary code on the web server hosting the WordPress site. This could lead to complete website takeover, data theft (including sensitive user information stored in the WordPress database), defacement, and the installation of malware. Given the plugin's function (displaying ads), attackers could also inject malicious advertisements to redirect users to phishing sites or distribute malware. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors.

1. Reserved2023-10-30
2. Published2023-10-30
3. Modified2025-02-05
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-5843 is to immediately upgrade the Ads by datafeedr.com plugin to a patched version. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. Web application firewalls (WAFs) can be configured to block requests to the vulnerable 'dfadsajaxload_ads' endpoint. Monitor WordPress access logs for suspicious activity, particularly requests originating from unfamiliar IP addresses targeting this endpoint. Review WordPress user permissions to ensure least privilege access.