The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the dfads_ajax_load_ads function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ads_by_datafeedr.com | Datafeedr | * | 1.1.3 (including) |