PT-2026-27060 · WordPress · Trx Addons

Erwan Lr · Published 2026-03-23 · Updated 2026-03-24 · CVE-2026-1969

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions trx addons WordPress plugin versions prior to 2.38.5

Description The software does not properly validate file types during an AJAX action, potentially allowing unauthenticated users to upload arbitrary files. This is related to a previous fix attempt.

Recommendations Update to version 2.38.5 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-1969

Affected Products

Trx Addons

References · 4

• 🔥 https://wpscan.com/vulnerability/762530ae-80a5-4ff8-9725-6adab9498c33 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1969 · Security Note
• https://twitter.com/CVEnew/status/2035992467967782917 · Twitter Post
• https://twitter.com/CVEarity/status/2036440286948462662 · Twitter Post