CVE-2020-10257: Themerex Addons

Critical severity, CVSS 9.8. EPSS: 8.9% chance of exploitation in the next 30 days.

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.

Affected products

• Themerex Addons: version 1.70.3 only; version 1.6.67 only; version 1.6.66 only; version 1.6.65 only; version 1.6.62.3 only; version 1.6.62.1 only; …
• Themerex Aldo-Gutenberg WordPress Blog Theme: before 1.0.2 (fixed in 1.0.2)
• Themerex Amuli: before 1.0.2 (fixed in 1.0.2)
• Themerex Blabber: before 1.5.2009 (fixed in 1.5.2009)
• Themerex Bonkozoo Zoo: before 1.0.3 (fixed in 1.0.3)
• Themerex Briny-Diving WordPress Theme: before 1.2.2000 (fixed in 1.2.2000)
• Themerex Bugster-Pests Control: before 1.0.2 (fixed in 1.0.2)
• Themerex Buzz Stone-Magazine & Blog: before 1.0.3 (fixed in 1.0.3)
• Themerex Chainpress: before 1.0.3 (fixed in 1.0.3)
• Themerex Chit Club-Board Games: before 1.0.1 (fixed in 1.0.1)
• Themerex Coinpress-Cryptocurrency Magazine & Blog WordPress Theme: before 1.0.2 (fixed in 1.0.2)
• Themerex Corredo Sport Event: before 1.1.2003 (fixed in 1.1.2003)
• Themerex Dronex-Aerial Photography Services: before 1.1.2001 (fixed in 1.1.2001)
• Themerex Especio-Food Gutenberg Theme: before 1.0.1 (fixed in 1.0.1)
• Themerex Fc United-Football: before 1.0.7 (fixed in 1.0.7)
• Themerex Gloss Blog: before 1.0.1 (fixed in 1.0.1)
• Themerex Gridiron: before 1.0.2 (fixed in 1.0.2)
• Themerex Hallelujah-Church: before 1.0.1 (fixed in 1.0.1)
• Themerex Heaven 11-Multiskin Property Theme: before 1.0.2 (fixed in 1.0.2)
• Themerex Helion-Agency &portfolio: before 1.0.3 (fixed in 1.0.3)
• Themerex Hobo Digital Nomad Blog: before 1.0.3 (fixed in 1.0.3)
• Themerex Impacto Patronus Multi-Landing: before 1.1.2001 (fixed in 1.1.2001)
• Themerex Justitia-Multiskin Lawyer Theme: before 1.0.3 (fixed in 1.0.3)
• Themerex Kargo-Freight Transport: before 1.1.2004 (fixed in 1.1.2004)
• Themerex Katelyn-Gutenberg WordPress Blog Theme: before 1.0.4 (fixed in 1.0.4)
• and 38 more

Published 2020-03-10. Last modified 2026-06-17.