CVE-2020-10257: Code Injection

Published Mar 9, 2020
·
Updated

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trxaddons/v2/get/sclayout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trxaddonsrestgetsclayout with an unsafe sc parameter.

Affected Software

124 affected components
All of the following
ThemeREX Addons Wordpress=1.70.3
ThemeREX Ozeum-museum Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.70.3
ThemeREX Chit Club-board Games Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.67
ThemeREX Yottis-simple Portfolio Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.66
ThemeREX Helion-agency \&portfolio Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.66
ThemeREX Amuli Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.65
ThemeREX Nelson-barbershop \+ Tattoo Salon Wordpress<1.0.1.2001
All of the following
ThemeREX Addons Wordpress=1.6.65
ThemeREX Hallelujah-church Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.65
ThemeREX Right Way Wordpress<4.0.1
All of the following
ThemeREX Addons Wordpress=1.6.65
ThemeREX Prider-pride Fest Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.62.3
ThemeREX Mystik-esoterics Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.62.3
ThemeREX Skydiving And Flying Company Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.62.1
ThemeREX Dronex-aerial Photography Services Wordpress<1.1.2001
All of the following
ThemeREX Addons Wordpress=1.6.61.2
ThemeREX Samadhi-buddhist Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.61.3
ThemeREX Tantum-rent A Car\, Rent A Bike\, Rent A Scooter Multiskin Theme Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.61.2
ThemeREX Scientia-public Library Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.61.2
ThemeREX Blabber Wordpress<1.5.2009
All of the following
ThemeREX Addons Wordpress=1.6.61.1
ThemeREX Impacto Patronus Multi-landing Wordpress<1.1.2001
All of the following
ThemeREX Addons Wordpress=1.6.61
ThemeREX Rare Radio Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.60
ThemeREX Piqes-creative Startup \& Agency Wordpress Theme Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.59.3
ThemeREX Kratz-digital Agency Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.59.2
ThemeREX Pixefy Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.59.1.1
ThemeREX Netmix-broadband \& Telecom Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.59
ThemeREX Kids Care Wordpress<3.0.5
All of the following
ThemeREX Addons Wordpress=1.6.58.2
ThemeREX Briny-diving Wordpress Theme Wordpress<1.2.2000
All of the following
ThemeREX Addons Wordpress=1.6.57.3
ThemeREX Tornados Wordpress<1.1.2001
All of the following
ThemeREX Addons Wordpress=1.6.57.4
ThemeREX Gridiron Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.57.2
ThemeREX Yungen-digital\/marketing Agency Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.57.3
ThemeREX Fc United-football Wordpress<1.0.7
All of the following
ThemeREX Addons Wordpress=1.6.57.2
ThemeREX Bugster-pests Control Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.57
ThemeREX Rumble-single Fighter Boxer\, News\, Gym\, Store Wordpress<1.0.4
All of the following
ThemeREX Addons Wordpress=1.6.56
ThemeREX Tacticool-shooting Range Wordpress Theme Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.55.4
ThemeREX Coinpress-cryptocurrency Magazine \& Blog Wordpress Theme Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.55.7
ThemeREX Vihara-ashram\, Buddhist Wordpress<1.1.2001
All of the following
ThemeREX Addons Wordpress=1.6.55.3
ThemeREX Katelyn-gutenberg Wordpress Blog Theme Wordpress<1.0.4
All of the following
ThemeREX Addons Wordpress=1.6.55.1
ThemeREX Heaven 11-multiskin Property Theme Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.54
ThemeREX Especio-food Gutenberg Theme Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.53.1
ThemeREX Partiso Electioncampaign Wordpress<1.1.2002
All of the following
ThemeREX Addons Wordpress=1.6.53.3
ThemeREX Kargo-freight Transport Wordpress<1.1.2004
All of the following
ThemeREX Addons Wordpress=1.6.53.2
ThemeREX Maxify-startup Blog Wordpress<1.0.4
All of the following
ThemeREX Addons Wordpress=1.6.53.1
ThemeREX Lingvico-language Learning School Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.53.2
ThemeREX Aldo-gutenberg Wordpress Blog Theme Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.52.2
ThemeREX Vixus-startup \/ Mobile Application Wordpress<1.0.4
All of the following
ThemeREX Addons Wordpress=1.6.52.1
ThemeREX Wellspring Water Filter Systems Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.52.1
ThemeREX Nazareth-church Wordpress<1.0.5
All of the following
ThemeREX Addons Wordpress=1.6.53
ThemeREX Tediss-soft Play Area\, Cafe \& Child Care Center Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.51.3
ThemeREX Yolox-startup Magazine \& Blog Wordpress Theme Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.51.3
ThemeREX Meals And Wheels-food Truck Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.51.1
ThemeREX Rosalinda-vegetarian \& Health Coach Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.50
ThemeREX Vapester Wordpress<1.1.2001
All of the following
ThemeREX Addons Wordpress=1.6.50
ThemeREX Modern Housewife-housewife And Family Blog Wordpress<1.0.2
All of the following
ThemeREX Addons Wordpress=1.6.50.1
ThemeREX Chainpress Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.51.1
ThemeREX Justitia-multiskin Lawyer Theme Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.50
ThemeREX Hobo Digital Nomad Blog Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.50.1
ThemeREX Rhodos-creative Corporate Wordpress Theme Wordpress<1.3.2001
All of the following
ThemeREX Addons Wordpress=1.6.50
ThemeREX Buzz Stone-magazine \& Blog Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.0.49.10
ThemeREX Corredo Sport Event Wordpress<1.1.2003
All of the following
ThemeREX Addons Wordpress=1.6.49.8
ThemeREX Savejulia Personal Fundraising Campaign Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.49.6
ThemeREX Bonkozoo Zoo Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.49.6.2
ThemeREX Renewal-plastic Surgeon Clinic Wordpress<1.0.3
All of the following
ThemeREX Addons Wordpress=1.6.49.5
ThemeREX Gloss Blog Wordpress<1.0.1
All of the following
ThemeREX Addons Wordpress=1.6.58.2
ThemeREX Plumbing-repair\, Building \& Construction Wordpress Theme Wordpress<3.0.1
All of the following
ThemeREX Addons Wordpress=1.6.61.2
ThemeREX Topper Theme And Skins Wordpress

Event History

Mar 9, 2020
CVE Published
via MITRE·11:41 PM
Data Sourced
via MITRE·11:41 PM
DescriptionSeverity

Frequently Asked Questions

1

What is CVE-2020-10257?

CVE-2020-10257 is a vulnerability in the ThemeREX Addons plugin for WordPress that lacks access control on a specific REST API endpoint, allowing for unauthorized execution of PHP functions.

2

What is the severity of CVE-2020-10257?

CVE-2020-10257 has a severity rating of 9.8, making it a critical vulnerability.

3

How can I fix CVE-2020-10257?

To fix CVE-2020-10257, users should update the ThemeREX Addons plugin to version 2020-03-09 or later, as this vulnerability has been patched in the updated version.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203