PT-2020-12010 · Themerex · Themerex Addons

Arne Breitsprecher + 1 · Published 2020-03-09 · Updated 2021-07-21 · CVE-2020-10257

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions ThemeREX Addons plugin versions prior to 2020-03-09

Description The issue concerns a lack of access control on the "/trx addons/v2/get/sc layout" API endpoint, allowing any user to execute PHP functions. This is due to the trx addons rest get sc layout function being called with an unsafe sc parameter in the includes/plugin.rest-api.php file.

Recommendations For ThemeREX Addons plugin versions prior to 2020-03-09, update to a version released after 2020-03-09 to resolve the issue. As a temporary workaround, consider restricting access to the "/trx addons/v2/get/sc layout" API endpoint to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Missing Authorization

Weakness Enumeration

CWE-94

CWE-862

Related Identifiers

CVE-2020-10257

Affected Products

Themerex Addons

References · 3

• 🔥 https://wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-10257 · Security Note
• https://t.me/cvenotify/1438 · Telegram Post