CVE-2023-5843

The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.

• CWE-94

• https://plugins.trac.wordpress.org/browser/ads-by-datafeedrcom/tags/1.1.3/inc/dfads.class.php#L34Exploit
• https://plugins.trac.wordpress.org/changeset/2991088/ads-by-datafeedrcom
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5412fd87-49bc-445c-8d16-443e38933d1e?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/ads-by-datafeedrcom/tags/1.1.3/inc/dfads.class.php#L34Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5412fd87-49bc-445c-8d16-443e38933d1e?source=cveThird Party Advisory

Published

Oct 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-5837A vulnerability classified as problematic was found in Alexa…6.1
• CVE-2023-5838Insufficient Session Expiration in GitHub repository linksta…9.8
• CVE-2023-5839Privilege Chaining in GitHub repository hestiacp/hestiacp pr…7.8
• CVE-2023-5840Weak Password Recovery Mechanism for Forgotten Password in G…8.8
• CVE-2023-5841Due to a failure in validating the number of scanline sample…9.1
• CVE-2023-5842Cross-site Scripting (XSS) - Stored in GitHub repository dol…4.8
• CVE-2023-5844Unverified Password Change in GitHub repository pimcore/admi…7.2
• CVE-2023-5845The Simple Social Media Share Buttons WordPress plugin befor…5.3
• CVE-2023-5846 Franklin Fueling System TS-550 versions prior to 1.9.23.896…9.8
• CVE-2023-5847 Under certain conditions, a low privileged attacker could l…7.3
• CVE-2023-5849Integer overflow in USB in Google Chrome prior to 119.0.6045…8.8
• CVE-2023-5850Incorrect security UI in Downloads in Google Chrome prior to…4.3