PT-2025-4001 · WordPress · Themerex Addons

István Márton

·

Published

2025-01-25

·

Updated

2025-08-08

·

CVE-2025-0682

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ThemeREX Addons plugin for WordPress versions up to and including 2.33.0
Description The issue arises from the trx sc reviews shortcode type attribute, allowing authenticated attackers with contributor-level or higher permissions to include and execute arbitrary files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution, particularly when PHP file types can be uploaded and included.
Recommendations For versions up to and including 2.33.0, consider disabling the trx sc reviews shortcode until a patch is available to prevent exploitation. Restrict access to the type attribute in the trx sc reviews shortcode to minimize the risk of arbitrary file inclusion. Avoid using the type attribute in the affected shortcode until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-0682

Affected Products

Themerex Addons