CVE-2020-10257

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-03-10 · updated 2026-06-17
Weakness: CWE-94

Description

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.

Affected products

ThemeREX Addons: 1.70.3, 1.6.67, 1.6.66, 1.6.65, 1.6.62.3, 1.6.62.1 (+35)
ThemeREX Aldo-Gutenberg Wordpress Blog Theme: before 1.0.2 — fixed in 1.0.2
ThemeREX Amuli: before 1.0.2 — fixed in 1.0.2
ThemeREX Blabber: before 1.5.2009 — fixed in 1.5.2009
ThemeREX Bonkozoo Zoo: before 1.0.3 — fixed in 1.0.3
ThemeREX Briny-Diving Wordpress Theme: before 1.2.2000 — fixed in 1.2.2000
ThemeREX Bugster-Pests Control: before 1.0.2 — fixed in 1.0.2
ThemeREX Buzz Stone-Magazine & Blog: before 1.0.3 — fixed in 1.0.3
ThemeREX Chainpress: before 1.0.3 — fixed in 1.0.3
ThemeREX Chit Club-Board Games: before 1.0.1 — fixed in 1.0.1
ThemeREX Coinpress-Cryptocurrency Magazine & Blog Wordpress Theme: before 1.0.2 — fixed in 1.0.2
ThemeREX Corredo Sport Event: before 1.1.2003 — fixed in 1.1.2003
ThemeREX Dronex-Aerial Photography Services: before 1.1.2001 — fixed in 1.1.2001
ThemeREX Especio-Food Gutenberg Theme: before 1.0.1 — fixed in 1.0.1
ThemeREX Fc United-Football: before 1.0.7 — fixed in 1.0.7
ThemeREX Gloss Blog: before 1.0.1 — fixed in 1.0.1
ThemeREX Gridiron: before 1.0.2 — fixed in 1.0.2
ThemeREX Hallelujah-Church: before 1.0.1 — fixed in 1.0.1
ThemeREX Heaven 11-Multiskin Property Theme: before 1.0.2 — fixed in 1.0.2
ThemeREX Helion-Agency &Portfolio: before 1.0.3 — fixed in 1.0.3
ThemeREX Hobo Digital Nomad Blog: before 1.0.3 — fixed in 1.0.3
ThemeREX Impacto Patronus Multi-Landing: before 1.1.2001 — fixed in 1.1.2001
ThemeREX Justitia-Multiskin Lawyer Theme: before 1.0.3 — fixed in 1.0.3
ThemeREX Kargo-Freight Transport: before 1.1.2004 — fixed in 1.1.2004
ThemeREX Katelyn-Gutenberg Wordpress Blog Theme: before 1.0.4 — fixed in 1.0.4
ThemeREX Kids Care: before 3.0.5 — fixed in 3.0.5
ThemeREX Kratz-Digital Agency: before 1.0.2 — fixed in 1.0.2
ThemeREX Lingvico-Language Learning School: before 1.0.3 — fixed in 1.0.3
ThemeREX Maxify-Startup Blog: before 1.0.4 — fixed in 1.0.4
ThemeREX Meals And Wheels-Food Truck: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: ThemeREX Aldo-Gutenberg Wordpress Blog Theme 1.0.2; ThemeREX Amuli 1.0.2; ThemeREX Blabber 1.5.2009; ThemeREX Bonkozoo Zoo 1.0.3; ThemeREX Briny-Diving Wordpress Theme 1.2.2000; ThemeREX Bugster-Pests Control 1.0.2; ThemeREX Buzz Stone-Magazine & Blog 1.0.3; ThemeREX Chainpress 1.0.3; ThemeREX Chit Club-Board Games 1.0.1; ThemeREX Coinpress-Cryptocurrency Magazine & Blog Wordpress Theme 1.0.2; ThemeREX Corredo Sport Event 1.1.2003; ThemeREX Dronex-Aerial Photography Services 1.1.2001. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-10257 or the next vulnerability affects your stack