CVE Feed

    Dashboard / CVE / CVE-2020-10257

    CVE-2020-10257

    The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.

    Published:Mar 9, 2020
    Last Modified:Nov 21, 2024
    EPS:Mar 9, 2020
    EPSS Score:0.01344
    CVSS Score:9.8

    Affected Products

    Vendor
    Themerex
    Product
    Addons
    Vendor
    Themerex
    Product
    Aldo-gutenberg Wordpress Blog Theme
    Vendor
    Themerex
    Product
    Amuli
    Vendor
    Themerex
    Product
    Blabber
    Vendor
    Themerex
    Product
    Bonkozoo Zoo
    Vendor
    Themerex
    Product
    Briny-diving Wordpress Theme
    Vendor
    Themerex
    Product
    Bugster-pests Control
    Vendor
    Themerex
    Product
    Buzz Stone-magazine \& Blog
    Vendor
    Themerex
    Product
    Chainpress
    Vendor
    Themerex
    Product
    Chit Club-board Games
    Vendor
    Themerex
    Product
    Coinpress-cryptocurrency Magazine \& Blog Wordpress Theme
    Vendor
    Themerex
    Product
    Corredo Sport Event
    Vendor
    Themerex
    Product
    Dronex-aerial Photography Services
    Vendor
    Themerex
    Product
    Especio-food Gutenberg Theme
    Vendor
    Themerex
    Product
    Fc United-football
    Vendor
    Themerex
    Product
    Gloss Blog
    Vendor
    Themerex
    Product
    Gridiron
    Vendor
    Themerex
    Product
    Hallelujah-church
    Vendor
    Themerex
    Product
    Heaven 11-multiskin Property Theme
    Vendor
    Themerex
    Product
    Helion-agency \&portfolio
    Vendor
    Themerex
    Product
    Hobo Digital Nomad Blog
    Vendor
    Themerex
    Product
    Impacto Patronus Multi-landing
    Vendor
    Themerex
    Product
    Justitia-multiskin Lawyer Theme
    Vendor
    Themerex
    Product
    Kargo-freight Transport
    Vendor
    Themerex
    Product
    Katelyn-gutenberg Wordpress Blog Theme
    Vendor
    Themerex
    Product
    Kids Care
    Vendor
    Themerex
    Product
    Kratz-digital Agency
    Vendor
    Themerex
    Product
    Lingvico-language Learning School
    Vendor
    Themerex
    Product
    Maxify-startup Blog
    Vendor
    Themerex
    Product
    Meals And Wheels-food Truck
    Vendor
    Themerex
    Product
    Modern Housewife-housewife And Family Blog
    Vendor
    Themerex
    Product
    Mystik-esoterics
    Vendor
    Themerex
    Product
    Nazareth-church
    Vendor
    Themerex
    Product
    Nelson-barbershop \+ Tattoo Salon
    Vendor
    Themerex
    Product
    Netmix-broadband \& Telecom
    Vendor
    Themerex
    Product
    Ozeum-museum
    Vendor
    Themerex
    Product
    Partiso Electioncampaign
    Vendor
    Themerex
    Product
    Piqes-creative Startup \& Agency Wordpress Theme
    Vendor
    Themerex
    Product
    Pixefy
    Vendor
    Themerex
    Product
    Plumbing-repair\, Building \& Construction Wordpress Theme
    Vendor
    Themerex
    Product
    Prider-pride Fest
    Vendor
    Themerex
    Product
    Rare Radio
    Vendor
    Themerex
    Product
    Renewal-plastic Surgeon Clinic
    Vendor
    Themerex
    Product
    Rhodos-creative Corporate Wordpress Theme
    Vendor
    Themerex
    Product
    Right Way
    Vendor
    Themerex
    Product
    Rosalinda-vegetarian \& Health Coach
    Vendor
    Themerex
    Product
    Rumble-single Fighter Boxer\, News\, Gym\, Store
    Vendor
    Themerex
    Product
    Samadhi-buddhist
    Vendor
    Themerex
    Product
    Savejulia Personal Fundraising Campaign
    Vendor
    Themerex
    Product
    Scientia-public Library
    Vendor
    Themerex
    Product
    Skydiving And Flying Company
    Vendor
    Themerex
    Product
    Tacticool-shooting Range Wordpress Theme
    Vendor
    Themerex
    Product
    Tantum-rent A Car\, Rent A Bike\, Rent A Scooter Multiskin Theme
    Vendor
    Themerex
    Product
    Tediss-soft Play Area\, Cafe \& Child Care Center
    Vendor
    Themerex
    Product
    Topper Theme And Skins
    Vendor
    Themerex
    Product
    Tornados
    Vendor
    Themerex
    Product
    Vapester
    Vendor
    Themerex
    Product
    Vihara-ashram\, Buddhist
    Vendor
    Themerex
    Product
    Vixus-startup \/ Mobile Application
    Vendor
    Themerex
    Product
    Wellspring Water Filter Systems
    Vendor
    Themerex
    Product
    Yolox-startup Magazine \& Blog Wordpress Theme
    Vendor
    Themerex
    Product
    Yottis-simple Portfolio
    Vendor
    Themerex
    Product
    Yungen-digital\/marketing Agency

    Exploits

    https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High