CVE-2020-10257
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the ...
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
- Record
CVE-2020-10257- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N - Updated
- 2026-11-02
EUVDEUVD-2020-2712
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
- Record
EUVD-2020-2712- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x679-h3r8-6399 No score
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the ...
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
- Record
GHSA-x679-h3r8-6399- Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
- Record
CVE-2020-10257- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94, CWE-862
- Updated
- 2026-11-02
Affected products
- themerex addons
- themerex aldo-gutenberg wordpress blog theme
- themerex amuli
- themerex blabber
- themerex bonkozoo zoo
- themerex briny-diving wordpress theme
- themerex bugster-pests control
- themerex buzz stone-magazine \& blog
- themerex chainpress
- themerex chit club-board games
- themerex coinpress-cryptocurrency magazine \& blog wordpress theme
- themerex corredo sport event
Show 51 moreShow less
- themerex dronex-aerial photography services
- themerex especio-food gutenberg theme
- themerex fc united-football
- themerex gloss blog
- themerex gridiron
- themerex hallelujah-church
- themerex heaven 11-multiskin property theme
- themerex helion-agency \&portfolio
- themerex hobo digital nomad blog
- themerex impacto patronus multi-landing
- themerex justitia-multiskin lawyer theme
- themerex kargo-freight transport
- themerex katelyn-gutenberg wordpress blog theme
- themerex kids care
- themerex kratz-digital agency
- themerex lingvico-language learning school
- themerex maxify-startup blog
- themerex meals and wheels-food truck
- themerex modern housewife-housewife and family blog
- themerex mystik-esoterics
- themerex nazareth-church
- themerex nelson-barbershop \+ tattoo salon
- themerex netmix-broadband \& telecom
- themerex ozeum-museum
- themerex partiso electioncampaign
- themerex piqes-creative startup \& agency wordpress theme
- themerex pixefy
- themerex plumbing-repair\, building \& construction wordpress theme
- themerex prider-pride fest
- themerex rare radio
- themerex renewal-plastic surgeon clinic
- themerex rhodos-creative corporate wordpress theme
- themerex right way
- themerex rosalinda-vegetarian \& health coach
- themerex rumble-single fighter boxer\, news\, gym\, store
- themerex samadhi-buddhist
- themerex savejulia personal fundraising campaign
- themerex scientia-public library
- themerex skydiving and flying company
- themerex tacticool-shooting range wordpress theme
- themerex tantum-rent a car\, rent a bike\, rent a scooter multiskin theme
- themerex tediss-soft play area\, cafe \& child care center
- themerex topper theme and skins
- themerex tornados
- themerex vapester
- themerex vihara-ashram\, buddhist
- themerex vixus-startup \/ mobile application
- themerex wellspring water filter systems
- themerex yolox-startup magazine \& blog wordpress theme
- themerex yottis-simple portfolio
- themerex yungen-digital\/marketing agency
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | ThemeREX Addons - Remote Code Execution | |
| PoC in GitHub | Darkcast/CVE-2020-10257 | 2025-04-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-10257 is a critical vulnerability (CVSS 9.8) in Themerex Addons, published March 9, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.88%, the 95th percentile. No source names a fixed version.