CVE-2020-10257: The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

addons (WordPress plugin) WordPress

Affected versions

=1.70.3 or =1.6.67 or =1.6.66 or =1.6.65 or =1.6.62.3 or =1.6.62.1 or =1.6.61.2 or =1.6.61.3 or =1.6.61.1 or =1.6.61 or =1.6.60 or =1.6.59.3 or =1.6.59.2 or =1.6.59.1.1 or =1.6.59 or =1.6.58.2 or =1.6.57.3 or =1.6.57.4 or =1.6.57.2 or =1.6.57 or =1.6.56 or =1.6.55.4 or =1.6.55.7 or =1.6.55.3 or =1.6.55.1 or =1.6.54 or =1.6.53.1 or =1.6.53.3 or =1.6.53.2 or =1.6.52.2 or =1.6.52.1 or =1.6.53 or =1.6.51.3 or =1.6.51.1 or =1.6.50 or =1.6.50.1 or =1.0.49.10 or =1.6.49.8 or =1.6.49.6 or =1.6.49.6.2 or =1.6.49.5

Fixed in

no fix recorded

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

aldo-gutenberg-wordpress-blog-theme (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

amuli (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

blabber (WordPress plugin) WordPress

Affected versions

<1.5.2009

Fixed in

1.5.2009

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

bonkozoo-zoo (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

briny-diving-wordpress-theme (WordPress plugin) WordPress

Affected versions

<1.2.2000

Fixed in

1.2.2000

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

bugster-pests-control (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

buzz-stone-magazine-\&-blog (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

chainpress (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

chit-club-board-games (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

coinpress-cryptocurrency-magazine-\&-blog-wordpress-theme (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

corredo-sport-event (WordPress plugin) WordPress

Affected versions

<1.1.2003

Fixed in

1.1.2003

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

dronex-aerial-photography-services (WordPress plugin) WordPress

Affected versions

<1.1.2001

Fixed in

1.1.2001

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

especio-food-gutenberg-theme (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

fc-united-football (WordPress plugin) WordPress

Affected versions

<1.0.7

Fixed in

1.0.7

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

gloss-blog (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

gridiron (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

hallelujah-church (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

heaven-11-multiskin-property-theme (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

helion-agency-\&portfolio (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

hobo-digital-nomad-blog (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

impacto-patronus-multi-landing (WordPress plugin) WordPress

Affected versions

<1.1.2001

Fixed in

1.1.2001

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

justitia-multiskin-lawyer-theme (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

kargo-freight-transport (WordPress plugin) WordPress

Affected versions

<1.1.2004

Fixed in

1.1.2004

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

katelyn-gutenberg-wordpress-blog-theme (WordPress plugin) WordPress

Affected versions

<1.0.4

Fixed in

1.0.4

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

kids-care (WordPress plugin) WordPress

Affected versions

<3.0.5

Fixed in

3.0.5

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

kratz-digital-agency (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

lingvico-language-learning-school (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

maxify-startup-blog (WordPress plugin) WordPress

Affected versions

<1.0.4

Fixed in

1.0.4

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

meals-and-wheels-food-truck (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

modern-housewife-housewife-and-family-blog (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

mystik-esoterics (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

nazareth-church (WordPress plugin) WordPress

Affected versions

<1.0.5

Fixed in

1.0.5

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

nelson-barbershop-\+-tattoo-salon (WordPress plugin) WordPress

Affected versions

<1.0.1.2001

Fixed in

1.0.1.2001

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

netmix-broadband-\&-telecom (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

ozeum-museum (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

partiso-electioncampaign (WordPress plugin) WordPress

Affected versions

<1.1.2002

Fixed in

1.1.2002

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

piqes-creative-startup-\&-agency-wordpress-theme (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

pixefy (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

plumbing-repair\,-building-\&-construction-wordpress-theme (WordPress plugin) WordPress

Affected versions

<3.0.1

Fixed in

3.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

prider-pride-fest (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

rare-radio (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

renewal-plastic-surgeon-clinic (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

rhodos-creative-corporate-wordpress-theme (WordPress plugin) WordPress

Affected versions

<1.3.2001

Fixed in

1.3.2001

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

right-way (WordPress plugin) WordPress

Affected versions

<4.0.1

Fixed in

4.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

rosalinda-vegetarian-\&-health-coach (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

rumble-single-fighter-boxer\,-news\,-gym\,-store (WordPress plugin) WordPress

Affected versions

<1.0.4

Fixed in

1.0.4

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

samadhi-buddhist (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

savejulia-personal-fundraising-campaign (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

scientia-public-library (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

skydiving-and-flying-company (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

tacticool-shooting-range-wordpress-theme (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

tantum-rent-a-car\,-rent-a-bike\,-rent-a-scooter-multiskin-theme (WordPress plugin) WordPress

Affected versions

<1.0.2

Fixed in

1.0.2

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

tediss-soft-play-area\,-cafe-\&-child-care-center (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

topper-theme-and-skins (WordPress plugin) WordPress

Affected versions

all versions

Fixed in

no fix recorded

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

tornados (WordPress plugin) WordPress

Affected versions

<1.1.2001

Fixed in

1.1.2001

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

vapester (WordPress plugin) WordPress

Affected versions

<1.1.2001

Fixed in

1.1.2001

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

vihara-ashram\,-buddhist (WordPress plugin) WordPress

Affected versions

<1.1.2001

Fixed in

1.1.2001

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

vixus-startup-\/-mobile-application (WordPress plugin) WordPress

Affected versions

<1.0.4

Fixed in

1.0.4

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

wellspring-water-filter-systems (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

yolox-startup-magazine-\&-blog-wordpress-theme (WordPress plugin) WordPress

Affected versions

<1.0.3

Fixed in

1.0.3

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

yottis-simple-portfolio (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because i

Package

yungen-digital\/marketing-agency (WordPress plugin) WordPress

Affected versions

<1.0.1

Fixed in

1.0.1

Severity

critical  CVSS 9.8

Exploitation

not on CISA KEV · EPSS 9% (95.2th percentile)

Published

2020-03-10

Source

nvd

References

• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
• https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

Related advisories

• CVE-2024-13448 critical The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to mi same package: addons (WordPress plugin)
• CVE-2025-0682 high The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all vers same package: addons (WordPress plugin)
• CVE-2025-6997 medium The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via same package: addons (WordPress plugin)
• CVE-2022-1329 high The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution same weakness: CWE-862
• CVE-2023-6875 critical The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for Wo same weakness: CWE-862
• CVE-2020-8772 critical The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization chec same weakness: CWE-862