Themerex · Themerex Addons · CVE-2020-10257
**Name of the Vulnerable Software and Affected Versions**
ThemeREX Addons plugin versions prior to 2020-03-09
**Description**
The issue concerns a lack of access control on the "/trx addons/v2/get/sc layout" API endpoint, allowing any user to execute PHP functions. This is due to the `trx addons rest get sc layout` function being called with an unsafe `sc` parameter in the includes/plugin.rest-api.php file.
**Recommendations**
For ThemeREX Addons plugin versions prior to 2020-03-09, update to a version released after 2020-03-09 to resolve the issue. As a temporary workaround, consider restricting access to the "/trx addons/v2/get/sc layout" API endpoint to minimize the risk of exploitation.