CVE-2024-13448

CRITICAL

ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13448 has a selected CVSS score of 9.8 (critical).

Description

The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 4, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 28, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

ThemeREX Addons

Browse ThemeREX / ThemeREX Addons

Default status: unaffected

CVE ListThrough 2.32.3affected

addons

Browse themerex / addons
VulnCheckVersion data not supplied

References

3