CVE-2020-10257

CRITICAL EXPLOITED IN THE WILD NUCLEI

Themerex Addons < 1.0.2 - Missing Authorization

Title source: rule

Description

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.

Nuclei Templates (1)

ThemeREX Addons - Remote Code Execution

CRITICALVERIFIEDby theamanrawat

Shodan: http.html:trx_addons

FOFA: body=trx_addons

References (1)

[Exploit, Third Party Advisory] https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/

Scores

CVSS v3 9.8

EPSS 0.6663

EPSS Percentile 98.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2020-03-09

InTheWild.io 2020-02-18

CWE

CWE-862 CWE-94

Status published

Products (50)

themerex/addons 1.70.3

themerex/addons 1.6.67

themerex/addons 1.6.66

themerex/addons 1.6.65

themerex/addons 1.6.62.3

themerex/addons 1.6.62.1

themerex/addons 1.6.61.2

themerex/addons 1.6.61.3

themerex/addons 1.6.61.1

themerex/addons 1.6.61

... and 40 more

Published Mar 10, 2020

Tracked Since Feb 18, 2026