PT-2023-32374 · WordPress · Ads By Datafeedr.Com

István Márton + 1 · Published 2023-10-30 · Updated 2023-11-13 · CVE-2023-5843

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ads by datafeedr.com plugin for WordPress versions up to, and including, 1.1.3

Description The issue allows unauthenticated attackers to execute code on the server via the dfads ajax load ads function. This function has limited parameters that cannot be specified arbitrarily, allowing for remote code execution.

Recommendations For versions up to, and including, 1.1.3, consider disabling the dfads ajax load ads function as a temporary workaround until a patch is available.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-5843

Affected Products

Ads By Datafeedr.Com

References · 7

• 🔥 https://plugins.trac.wordpress.org/browser/ads-by-datafeedrcom/tags/1.1.3/inc/dfads.class.php#L34 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-5843 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5843 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2991088/ads-by-datafeedrcom · Note
• https://twitter.com/VulmonFeeds/status/1719034196042162646 · Twitter Post
• https://twitter.com/CVEnew/status/1718994955731955815 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5412fd87-49bc-445c-8d16-443e38933d1e?source=cve · Note