CVE-2026-102797: WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress ThemeREX Addonsto a version that resolves this vulnerability.Fixed in 2.47.0
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-privileged access, as indicated by the PR:L attack vector. It does not require user interaction and can be exploited over the network.
What security impact can successful exploitation have?
Successful exploitation may expose limited confidential information and permit limited integrity impact. The CVSS vector indicates no direct availability impact, but the scope can affect components beyond the vulnerable plugin.
Which installations should be considered affected?
ThemeREX Addons versions through 2.46.0 are affected. The available data does not state whether the vulnerable functionality is enabled or reachable in the plugin's default configuration.