CVE-2020-10257
Summary
| CVE | CVE-2020-10257 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-03-10 00:15:00 UTC |
| Updated | 2021-07-21 11:39:00 UTC |
| Description | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter. |
Risk And Classification
Problem Types: CWE-94 | CWE-862
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Themerex | Addons | 1.0.49.10 | All | All | All |
| Application | Themerex | Addons | 1.6.49.5 | All | All | All |
| Application | Themerex | Addons | 1.6.49.6 | All | All | All |
| Application | Themerex | Addons | 1.6.49.6.2 | All | All | All |
| Application | Themerex | Addons | 1.6.49.8 | All | All | All |
| Application | Themerex | Addons | 1.6.50 | All | All | All |
| Application | Themerex | Addons | 1.6.50.1 | All | All | All |
| Application | Themerex | Addons | 1.6.51.1 | All | All | All |
| Application | Themerex | Addons | 1.6.51.3 | All | All | All |
| Application | Themerex | Addons | 1.6.52.1 | All | All | All |
| Application | Themerex | Addons | 1.6.52.2 | All | All | All |
| Application | Themerex | Addons | 1.6.53 | All | All | All |
| Application | Themerex | Addons | 1.6.53.1 | All | All | All |
| Application | Themerex | Addons | 1.6.53.2 | All | All | All |
| Application | Themerex | Addons | 1.6.53.3 | All | All | All |
| Application | Themerex | Addons | 1.6.54 | All | All | All |
| Application | Themerex | Addons | 1.6.55.1 | All | All | All |
| Application | Themerex | Addons | 1.6.55.3 | All | All | All |
| Application | Themerex | Addons | 1.6.55.4 | All | All | All |
| Application | Themerex | Addons | 1.6.55.7 | All | All | All |
| Application | Themerex | Addons | 1.6.56 | All | All | All |
| Application | Themerex | Addons | 1.6.57 | All | All | All |
| Application | Themerex | Addons | 1.6.57.2 | All | All | All |
| Application | Themerex | Addons | 1.6.57.3 | All | All | All |
| Application | Themerex | Addons | 1.6.57.4 | All | All | All |
| Application | Themerex | Addons | 1.6.58.2 | All | All | All |
| Application | Themerex | Addons | 1.6.59 | All | All | All |
| Application | Themerex | Addons | 1.6.59.1.1 | All | All | All |
| Application | Themerex | Addons | 1.6.59.2 | All | All | All |
| Application | Themerex | Addons | 1.6.59.3 | All | All | All |
| Application | Themerex | Addons | 1.6.60 | All | All | All |
| Application | Themerex | Addons | 1.6.61 | All | All | All |
| Application | Themerex | Addons | 1.6.61.1 | All | All | All |
| Application | Themerex | Addons | 1.6.61.2 | All | All | All |
| Application | Themerex | Addons | 1.6.61.3 | All | All | All |
| Application | Themerex | Addons | 1.6.62.1 | All | All | All |
| Application | Themerex | Addons | 1.6.62.3 | All | All | All |
| Application | Themerex | Addons | 1.6.65 | All | All | All |
| Application | Themerex | Addons | 1.6.66 | All | All | All |
| Application | Themerex | Addons | 1.6.67 | All | All | All |
| Application | Themerex | Addons | 1.70.3 | All | All | All |
| Application | Themerex | Addons | 1.0.49.10 | All | All | All |
| Application | Themerex | Addons | 1.6.49.5 | All | All | All |
| Application | Themerex | Addons | 1.6.49.6 | All | All | All |
| Application | Themerex | Addons | 1.6.49.6.2 | All | All | All |
| Application | Themerex | Addons | 1.6.49.8 | All | All | All |
| Application | Themerex | Addons | 1.6.50 | All | All | All |
| Application | Themerex | Addons | 1.6.50.1 | All | All | All |
| Application | Themerex | Addons | 1.6.51.1 | All | All | All |
| Application | Themerex | Addons | 1.6.51.3 | All | All | All |
| Application | Themerex | Addons | 1.6.52.1 | All | All | All |
| Application | Themerex | Addons | 1.6.52.2 | All | All | All |
| Application | Themerex | Addons | 1.6.53 | All | All | All |
| Application | Themerex | Addons | 1.6.53.1 | All | All | All |
| Application | Themerex | Addons | 1.6.53.2 | All | All | All |
| Application | Themerex | Addons | 1.6.53.3 | All | All | All |
| Application | Themerex | Addons | 1.6.54 | All | All | All |
| Application | Themerex | Addons | 1.6.55.1 | All | All | All |
| Application | Themerex | Addons | 1.6.55.3 | All | All | All |
| Application | Themerex | Addons | 1.6.55.4 | All | All | All |
| Application | Themerex | Addons | 1.6.55.7 | All | All | All |
| Application | Themerex | Addons | 1.6.56 | All | All | All |
| Application | Themerex | Addons | 1.6.57 | All | All | All |
| Application | Themerex | Addons | 1.6.57.2 | All | All | All |
| Application | Themerex | Addons | 1.6.57.3 | All | All | All |
| Application | Themerex | Addons | 1.6.57.4 | All | All | All |
| Application | Themerex | Addons | 1.6.58.2 | All | All | All |
| Application | Themerex | Addons | 1.6.59 | All | All | All |
| Application | Themerex | Addons | 1.6.59.1.1 | All | All | All |
| Application | Themerex | Addons | 1.6.59.2 | All | All | All |
| Application | Themerex | Addons | 1.6.59.3 | All | All | All |
| Application | Themerex | Addons | 1.6.60 | All | All | All |
| Application | Themerex | Addons | 1.6.61 | All | All | All |
| Application | Themerex | Addons | 1.6.61.1 | All | All | All |
| Application | Themerex | Addons | 1.6.61.2 | All | All | All |
| Application | Themerex | Addons | 1.6.61.3 | All | All | All |
| Application | Themerex | Addons | 1.6.62.1 | All | All | All |
| Application | Themerex | Addons | 1.6.62.3 | All | All | All |
| Application | Themerex | Addons | 1.6.65 | All | All | All |
| Application | Themerex | Addons | 1.6.66 | All | All | All |
| Application | Themerex | Addons | 1.6.67 | All | All | All |
| Application | Themerex | Addons | 1.70.3 | All | All | All |
| Application | Themerex | Aldo-gutenberg Wordpress Blog Theme | All | All | All | All |
| Application | Themerex | Aldo-gutenberg Wordpress Blog Theme | All | All | All | All |
| Application | Themerex | Amuli | All | All | All | All |
| Application | Themerex | Amuli | All | All | All | All |
| Application | Themerex | Blabber | All | All | All | All |
| Application | Themerex | Blabber | All | All | All | All |
| Application | Themerex | Bonkozoo Zoo | All | All | All | All |
| Application | Themerex | Bonkozoo Zoo | All | All | All | All |
| Application | Themerex | Briny-diving Wordpress Theme | All | All | All | All |
| Application | Themerex | Briny-diving Wordpress Theme | All | All | All | All |
| Application | Themerex | Bugster-pests Control | All | All | All | All |
| Application | Themerex | Bugster-pests Control | All | All | All | All |
| Application | Themerex | Buzz Stone-magazine Blog | All | All | All | All |
| Application | Themerex | Buzz Stone-magazine Blog | All | All | All | All |
| Application | Themerex | Chainpress | All | All | All | All |
| Application | Themerex | Chainpress | All | All | All | All |
| Application | Themerex | Chit Club-board Games | All | All | All | All |
| Application | Themerex | Chit Club-board Games | All | All | All | All |
| Application | Themerex | Coinpress-cryptocurrency Magazine Blog Wordpress Theme | All | All | All | All |
| Application | Themerex | Coinpress-cryptocurrency Magazine Blog Wordpress Theme | All | All | All | All |
| Application | Themerex | Corredo Sport Event | All | All | All | All |
| Application | Themerex | Corredo Sport Event | All | All | All | All |
| Application | Themerex | Dronex-aerial Photography Services | All | All | All | All |
| Application | Themerex | Dronex-aerial Photography Services | All | All | All | All |
| Application | Themerex | Especio-food Gutenberg Theme | All | All | All | All |
| Application | Themerex | Especio-food Gutenberg Theme | All | All | All | All |
| Application | Themerex | Fc United-football | All | All | All | All |
| Application | Themerex | Fc United-football | All | All | All | All |
| Application | Themerex | Gloss Blog | All | All | All | All |
| Application | Themerex | Gloss Blog | All | All | All | All |
| Application | Themerex | Gridiron | All | All | All | All |
| Application | Themerex | Gridiron | All | All | All | All |
| Application | Themerex | Hallelujah-church | All | All | All | All |
| Application | Themerex | Hallelujah-church | All | All | All | All |
| Application | Themerex | Heaven 11-multiskin Property Theme | All | All | All | All |
| Application | Themerex | Heaven 11-multiskin Property Theme | All | All | All | All |
| Application | Themerex | Helion-agency Portfolio | All | All | All | All |
| Application | Themerex | Helion-agency Portfolio | All | All | All | All |
| Application | Themerex | Hobo Digital Nomad Blog | All | All | All | All |
| Application | Themerex | Hobo Digital Nomad Blog | All | All | All | All |
| Application | Themerex | Impacto Patronus Multi-landing | All | All | All | All |
| Application | Themerex | Impacto Patronus Multi-landing | All | All | All | All |
| Application | Themerex | Justitia-multiskin Lawyer Theme | All | All | All | All |
| Application | Themerex | Justitia-multiskin Lawyer Theme | All | All | All | All |
| Application | Themerex | Kargo-freight Transport | All | All | All | All |
| Application | Themerex | Kargo-freight Transport | All | All | All | All |
| Application | Themerex | Katelyn-gutenberg Wordpress Blog Theme | All | All | All | All |
| Application | Themerex | Katelyn-gutenberg Wordpress Blog Theme | All | All | All | All |
| Application | Themerex | Kids Care | All | All | All | All |
| Application | Themerex | Kids Care | All | All | All | All |
| Application | Themerex | Kratz-digital Agency | All | All | All | All |
| Application | Themerex | Kratz-digital Agency | All | All | All | All |
| Application | Themerex | Lingvico-language Learning School | All | All | All | All |
| Application | Themerex | Lingvico-language Learning School | All | All | All | All |
| Application | Themerex | Maxify-startup Blog | All | All | All | All |
| Application | Themerex | Maxify-startup Blog | All | All | All | All |
| Application | Themerex | Meals And Wheels-food Truck | All | All | All | All |
| Application | Themerex | Meals And Wheels-food Truck | All | All | All | All |
| Application | Themerex | Modern Housewife-housewife And Family Blog | All | All | All | All |
| Application | Themerex | Modern Housewife-housewife And Family Blog | All | All | All | All |
| Application | Themerex | Mystik-esoterics | All | All | All | All |
| Application | Themerex | Mystik-esoterics | All | All | All | All |
| Application | Themerex | Nazareth-church | All | All | All | All |
| Application | Themerex | Nazareth-church | All | All | All | All |
| Application | Themerex | Nelson-barbershop Tattoo Salon | All | All | All | All |
| Application | Themerex | Nelson-barbershop Tattoo Salon | All | All | All | All |
| Application | Themerex | Netmix-broadband Telecom | All | All | All | All |
| Application | Themerex | Netmix-broadband Telecom | All | All | All | All |
| Application | Themerex | Ozeum-museum | All | All | All | All |
| Application | Themerex | Ozeum-museum | All | All | All | All |
| Application | Themerex | Partiso Electioncampaign | All | All | All | All |
| Application | Themerex | Partiso Electioncampaign | All | All | All | All |
| Application | Themerex | Piqes-creative Startup Agency Wordpress Theme | All | All | All | All |
| Application | Themerex | Piqes-creative Startup Agency Wordpress Theme | All | All | All | All |
| Application | Themerex | Pixefy | All | All | All | All |
| Application | Themerex | Pixefy | All | All | All | All |
| Application | Themerex | Plumbing-repair Building Construction Wordpress Theme | All | All | All | All |
| Application | Themerex | Plumbing-repair Building Construction Wordpress Theme | All | All | All | All |
| Application | Themerex | Prider-pride Fest | All | All | All | All |
| Application | Themerex | Prider-pride Fest | All | All | All | All |
| Application | Themerex | Rare Radio | All | All | All | All |
| Application | Themerex | Rare Radio | All | All | All | All |
| Application | Themerex | Renewal-plastic Surgeon Clinic | All | All | All | All |
| Application | Themerex | Renewal-plastic Surgeon Clinic | All | All | All | All |
| Application | Themerex | Rhodos-creative Corporate Wordpress Theme | All | All | All | All |
| Application | Themerex | Rhodos-creative Corporate Wordpress Theme | All | All | All | All |
| Application | Themerex | Right Way | All | All | All | All |
| Application | Themerex | Right Way | All | All | All | All |
| Application | Themerex | Rosalinda-vegetarian Health Coach | All | All | All | All |
| Application | Themerex | Rosalinda-vegetarian Health Coach | All | All | All | All |
| Application | Themerex | Rumble-single Fighter Boxer News Gym Store | All | All | All | All |
| Application | Themerex | Rumble-single Fighter Boxer News Gym Store | All | All | All | All |
| Application | Themerex | Samadhi-buddhist | All | All | All | All |
| Application | Themerex | Samadhi-buddhist | All | All | All | All |
| Application | Themerex | Savejulia Personal Fundraising Campaign | All | All | All | All |
| Application | Themerex | Savejulia Personal Fundraising Campaign | All | All | All | All |
| Application | Themerex | Scientia-public Library | All | All | All | All |
| Application | Themerex | Scientia-public Library | All | All | All | All |
| Application | Themerex | Skydiving And Flying Company | All | All | All | All |
| Application | Themerex | Skydiving And Flying Company | All | All | All | All |
| Application | Themerex | Tacticool-shooting Range Wordpress Theme | All | All | All | All |
| Application | Themerex | Tacticool-shooting Range Wordpress Theme | All | All | All | All |
| Application | Themerex | Tantum-rent A Car Rent A Bike Rent A Scooter Multiskin Theme | All | All | All | All |
| Application | Themerex | Tantum-rent A Car Rent A Bike Rent A Scooter Multiskin Theme | All | All | All | All |
| Application | Themerex | Tediss-soft Play Area Cafe Child Care Center | All | All | All | All |
| Application | Themerex | Tediss-soft Play Area Cafe Child Care Center | All | All | All | All |
| Application | Themerex | Topper Theme And Skins | - | All | All | All |
| Application | Themerex | Topper Theme And Skins | - | All | All | All |
| Application | Themerex | Tornados | All | All | All | All |
| Application | Themerex | Tornados | All | All | All | All |
| Application | Themerex | Vapester | All | All | All | All |
| Application | Themerex | Vapester | All | All | All | All |
| Application | Themerex | Vihara-ashram Buddhist | All | All | All | All |
| Application | Themerex | Vihara-ashram Buddhist | All | All | All | All |
| Application | Themerex | Vixus-startup / Mobile Application | All | All | All | All |
| Application | Themerex | Vixus-startup / Mobile Application | All | All | All | All |
| Application | Themerex | Wellspring Water Filter Systems | All | All | All | All |
| Application | Themerex | Wellspring Water Filter Systems | All | All | All | All |
| Application | Themerex | Yolox-startup Magazine Blog Wordpress Theme | All | All | All | All |
| Application | Themerex | Yolox-startup Magazine Blog Wordpress Theme | All | All | All | All |
| Application | Themerex | Yottis-simple Portfolio | All | All | All | All |
| Application | Themerex | Yottis-simple Portfolio | All | All | All | All |
| Application | Themerex | Yungen-digital/marketing Agency | All | All | All | All |
| Application | Themerex | Yungen-digital/marketing Agency | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Zero-Day Vulnerability in ThemeREX Addons Now Patched | MISC | www.wordfence.com | Exploit, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.