De Ads by datafeedr.com plugin voor WordPress is kwetsbaar voor Remote Code Execution in versies tot en met 1.1.3 via de 'dfads_ajax_load_ads' functie. Dit stelt ongeauthenticeerde aanvallers in staat

The impact of CVE-2023-5843 is severe. Successful exploitation allows an attacker to execute arbitrary code on the web server hosting the WordPress site. This could lead to complete website takeover, data theft (including sensitive user information stored in the WordPress database), defacement, and the installation of malware. Given the plugin's function (displaying ads), attackers could also inject malicious advertisements to redirect users to phishing sites or distribute malware. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors.

Websites using the Ads by datafeedr.com plugin, particularly those running older, unpatched versions (≤1.1.3), are at significant risk. Shared hosting environments are especially vulnerable, as attackers could potentially compromise multiple websites through a single plugin vulnerability. Sites with weak WordPress security configurations or outdated plugins are also at increased risk.

• wordpress / composer / npm:

grep -r 'dfads_ajax_load_ads' /var/www/html/wp-content/plugins/datafeedr-ads/

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=dfads_ajax_load_ads

• wordpress / composer / npm:

wp plugin list | grep datafeedr-ads

1. 2023-10-30Disclosure

   disclosure

1. Gereserveerd2023-10-30
2. Gepubliceerd2023-10-30
3. Gewijzigd2025-02-05
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2023-5843 is to immediately upgrade the Ads by datafeedr.com plugin to a patched version. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. Web application firewalls (WAFs) can be configured to block requests to the vulnerable 'dfadsajaxload_ads' endpoint. Monitor WordPress access logs for suspicious activity, particularly requests originating from unfamiliar IP addresses targeting this endpoint. Review WordPress user permissions to ensure least privilege access.