Vulnerability CVE-2020-10257
Published: 2020-03-10

Description:
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.

Type:

CWE-94

 (Improper Control of Generation of Code ('Code Injection'))

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Themerex -> Scientia-public library 
Themerex -> Tacticool-shooting range wordpress theme 
Themerex -> Meals and wheels-food truck 
Themerex -> Addons 
Themerex -> Blabber 
Themerex -> Coinpress-cryptocurrency magazine \& blog wordpress theme 
Themerex -> Rosalinda-vegetarian \& health coach 
Themerex -> Ozeum-museum 
Themerex -> Impacto patronus multi-landing 
Themerex -> Vihara-ashram\, buddhist 
Themerex -> Vapester 
Themerex -> Chit club-board games 
Themerex -> Rare radio 
Themerex -> Katelyn-gutenberg wordpress blog theme 
Themerex -> Modern housewife-housewife and family blog 
Themerex -> Yottis-simple portfolio 
Themerex -> Piqes-creative startup \& agency wordpress theme 
Themerex -> Heaven 11-multiskin property theme 
Themerex -> Chainpress 
Themerex -> Helion-agency \&portfolio 
Themerex -> Kratz-digital agency 
Themerex -> Especio-food gutenberg theme 
Themerex -> Justitia-multiskin lawyer theme 
Themerex -> Amuli 
Themerex -> Pixefy 
Themerex -> Partiso electioncampaign 
Themerex -> Hobo digital nomad blog 
Themerex -> Nelson-barbershop \+ tattoo salon 
Themerex -> Netmix-broadband \& telecom 
Themerex -> Kargo-freight transport 
Themerex -> Rhodos-creative corporate wordpress theme 
Themerex -> Hallelujah-church 
Themerex -> Kids care 
Themerex -> Maxify-startup blog 
Themerex -> Buzz stone-magazine \& blog 
Themerex -> Right way 
Themerex -> Briny-diving wordpress theme 
Themerex -> Lingvico-language learning school 
Themerex -> Corredo sport event 
Themerex -> Prider-pride fest 
Themerex -> Tornados 
Themerex -> Aldo-gutenberg wordpress blog theme 
Themerex -> Savejulia personal fundraising campaign 
Themerex -> Mystik-esoterics 
Themerex -> Gridiron 
Themerex -> Vixus-startup \/ mobile application 
Themerex -> Bonkozoo zoo 
Themerex -> Skydiving and flying company 
Themerex -> Yungen-digital\/marketing agency 
Themerex -> Wellspring water filter systems 
Themerex -> Renewal-plastic surgeon clinic 
Themerex -> Dronex-aerial photography services 
Themerex -> Fc united-football 
Themerex -> Nazareth-church 
Themerex -> Gloss blog 
Themerex -> Samadhi-buddhist 
Themerex -> Bugster-pests control 
Themerex -> Tediss-soft play area\, cafe \& child care center 
Themerex -> Plumbing-repair\, building \& construction wordpress theme 
Themerex -> Tantum-rent a car\, rent a bike\, rent a scooter multiskin theme 
Themerex -> Rumble-single fighter boxer\, news\, gym\, store 
Themerex -> Yolox-startup magazine \& blog wordpress theme 
Themerex -> Topper theme and skins 

 References:
https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
Copyright 2025, cxsecurity.com

 

Back to Top