CVE-2020-10257
9.8
CRITICAL · CVSS 3.1 · EPSS 8.9% (pctl 95)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 8.88% — more likely to be exploited than 95% of all CVEs |
| Weakness | CWE-94 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-03-10 |
| Last modified | 2026-06-17 |
Affected (40)
| Vendor | Product |
|---|---|
| themerex | addons |
| themerex | amuli |
| themerex | blabber |
| themerex | briny-diving wordpress theme |
| themerex | bugster-pests control |
| themerex | chit club-board games |
| themerex | coinpress-cryptocurrency magazine \& blog wordpress theme |
| themerex | dronex-aerial photography services |
| themerex | especio-food gutenberg theme |
| themerex | fc united-football |
| themerex | gridiron |
| themerex | hallelujah-church |
| themerex | heaven 11-multiskin property theme |
| themerex | helion-agency \&portfolio |
| themerex | impacto patronus multi-landing |
| themerex | kargo-freight transport |
| themerex | katelyn-gutenberg wordpress blog theme |
| themerex | kids care |
| themerex | kratz-digital agency |
| themerex | maxify-startup blog |
| themerex | mystik-esoterics |
| themerex | nelson-barbershop \+ tattoo salon |
| themerex | netmix-broadband \& telecom |
| themerex | ozeum-museum |
| themerex | partiso electioncampaign |
| themerex | piqes-creative startup \& agency wordpress theme |
| themerex | pixefy |
| themerex | prider-pride fest |
| themerex | rare radio |
| themerex | right way |
| themerex | rumble-single fighter boxer\, news\, gym\, store |
| themerex | samadhi-buddhist |
| themerex | scientia-public library |
| themerex | skydiving and flying company |
| themerex | tacticool-shooting range wordpress theme |
| themerex | tantum-rent a car\, rent a bike\, rent a scooter multiskin theme |
| themerex | tornados |
| themerex | vihara-ashram\, buddhist |
| themerex | yottis-simple portfolio |
| themerex | yungen-digital\/marketing agency |
References
→ the Explorer · watch your stack · NVD