CVE-2026-1969

MEDIUM EXPLOITED

ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-1969 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including HORKimhab.

AI-analyzed exploit summary The repository contains a placeholder markdown file for CVE-2026-1969, describing an unauthenticated arbitrary file upload vulnerability in the ThemeREX Addons WordPress plugin (versions < 2.38.5). No exploit code or technical details beyond a brief description are provided.

Description

The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448

Exploits (1)

github STUB
by HORKimhab · poc
https://github.com/HORKimhab/poc-cve-collection/tree/main/2026/1xxx/CVE-2026-1969.md

The repository contains a placeholder markdown file for CVE-2026-1969, describing an unauthenticated arbitrary file upload vulnerability in the ThemeREX Addons WordPress plugin (versions < 2.38.5). No exploit code or technical details beyond a brief description are provided.

Classification
Stub 95%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: ThemeREX Addons WordPress plugin < 2.38.5
No auth needed
Prerequisites: Target must be running a vulnerable version of ThemeREX Addons WordPress plugin (< 2.38.5)
mistral-large-3 · analyzed Jul 10, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit exploit vdb-entry technical-description
https://wpscan.com/vulnerability/762530ae-80a5-4ff8-9725-6adab9498c33/

Scores

CVSS v3 5.3
EPSS 0.0029
EPSS Percentile 21.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2026-04-30
CWE
CWE-434
Status published
Products (1)
Unknown/trx_addons < 2.38.5
Published Mar 23, 2026
Tracked Since Mar 23, 2026