{"id":"CVE-2020-10257","aliases":["EUVD-2020-2712","GHSA-x679-h3r8-6399"],"status":"published","title":"The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the ...","description":"The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.08877,"percentile":0.95285,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-862","CWE-94"],"published":"2020-03-09T23:41:34Z","modified":"2026-06-17T02:47:34Z","exploits":[{"source":"pocgithub","id":"Darkcast/CVE-2020-10257","title":"Darkcast/CVE-2020-10257","date":"2025-04-23","url":"https://github.com/Darkcast/CVE-2020-10257"},{"source":"nuclei","id":"CVE-2020-10257","title":"ThemeREX Addons - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10257.yaml"}],"products":[{"vendor":"themerex","product":"addons"},{"vendor":"themerex","product":"aldo-gutenberg_wordpress_blog_theme"},{"vendor":"themerex","product":"amuli"},{"vendor":"themerex","product":"blabber"},{"vendor":"themerex","product":"bonkozoo_zoo"},{"vendor":"themerex","product":"briny-diving_wordpress_theme"},{"vendor":"themerex","product":"bugster-pests_control"},{"vendor":"themerex","product":"buzz_stone-magazine_\\\u0026_blog"},{"vendor":"themerex","product":"chainpress"},{"vendor":"themerex","product":"chit_club-board_games"},{"vendor":"themerex","product":"coinpress-cryptocurrency_magazine_\\\u0026_blog_wordpress_theme"},{"vendor":"themerex","product":"corredo_sport_event"},{"vendor":"themerex","product":"dronex-aerial_photography_services"},{"vendor":"themerex","product":"especio-food_gutenberg_theme"},{"vendor":"themerex","product":"fc_united-football"},{"vendor":"themerex","product":"gloss_blog"},{"vendor":"themerex","product":"gridiron"},{"vendor":"themerex","product":"hallelujah-church"},{"vendor":"themerex","product":"heaven_11-multiskin_property_theme"},{"vendor":"themerex","product":"helion-agency_\\\u0026portfolio"},{"vendor":"themerex","product":"hobo_digital_nomad_blog"},{"vendor":"themerex","product":"impacto_patronus_multi-landing"},{"vendor":"themerex","product":"justitia-multiskin_lawyer_theme"},{"vendor":"themerex","product":"kargo-freight_transport"},{"vendor":"themerex","product":"katelyn-gutenberg_wordpress_blog_theme"},{"vendor":"themerex","product":"kids_care"},{"vendor":"themerex","product":"kratz-digital_agency"},{"vendor":"themerex","product":"lingvico-language_learning_school"},{"vendor":"themerex","product":"maxify-startup_blog"},{"vendor":"themerex","product":"meals_and_wheels-food_truck"},{"vendor":"themerex","product":"modern_housewife-housewife_and_family_blog"},{"vendor":"themerex","product":"mystik-esoterics"},{"vendor":"themerex","product":"nazareth-church"},{"vendor":"themerex","product":"nelson-barbershop_\\+_tattoo_salon"},{"vendor":"themerex","product":"netmix-broadband_\\\u0026_telecom"},{"vendor":"themerex","product":"ozeum-museum"},{"vendor":"themerex","product":"partiso_electioncampaign"},{"vendor":"themerex","product":"piqes-creative_startup_\\\u0026_agency_wordpress_theme"},{"vendor":"themerex","product":"pixefy"},{"vendor":"themerex","product":"plumbing-repair\\,_building_\\\u0026_construction_wordpress_theme"},{"vendor":"themerex","product":"prider-pride_fest"},{"vendor":"themerex","product":"rare_radio"},{"vendor":"themerex","product":"renewal-plastic_surgeon_clinic"},{"vendor":"themerex","product":"rhodos-creative_corporate_wordpress_theme"},{"vendor":"themerex","product":"right_way"},{"vendor":"themerex","product":"rosalinda-vegetarian_\\\u0026_health_coach"},{"vendor":"themerex","product":"rumble-single_fighter_boxer\\,_news\\,_gym\\,_store"},{"vendor":"themerex","product":"samadhi-buddhist"},{"vendor":"themerex","product":"savejulia_personal_fundraising_campaign"},{"vendor":"themerex","product":"scientia-public_library"},{"vendor":"themerex","product":"skydiving_and_flying_company"},{"vendor":"themerex","product":"tacticool-shooting_range_wordpress_theme"},{"vendor":"themerex","product":"tantum-rent_a_car\\,_rent_a_bike\\,_rent_a_scooter_multiskin_theme"},{"vendor":"themerex","product":"tediss-soft_play_area\\,_cafe_\\\u0026_child_care_center"},{"vendor":"themerex","product":"topper_theme_and_skins"},{"vendor":"themerex","product":"tornados"},{"vendor":"themerex","product":"vapester"},{"vendor":"themerex","product":"vihara-ashram\\,_buddhist"},{"vendor":"themerex","product":"vixus-startup_\\/_mobile_application"},{"vendor":"themerex","product":"wellspring_water_filter_systems"},{"vendor":"themerex","product":"yolox-startup_magazine_\\\u0026_blog_wordpress_theme"},{"vendor":"themerex","product":"yottis-simple_portfolio"},{"vendor":"themerex","product":"yungen-digital\\/marketing_agency"}],"references":[{"url":"https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10257"},{"url":"https://github.com/advisories/GHSA-x679-h3r8-6399"}],"sources":{"cve":[{"id":"CVE-2020-10257","description":"The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.","status":"published","published":"2020-03-09T23:41:34Z","modified":"2024-08-04T10:58:40.181Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2020-2712","description":"The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.","status":"published","published":"2020-03-09T23:41:34Z","modified":"2024-08-04T10:58:40Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N","level":"critical"}],"updated_at":"2026-11-03T03:07:50.893254Z"}],"ghsa":[{"id":"GHSA-x679-h3r8-6399","title":"The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the ...","description":"The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.","status":"published","published":"2022-05-24T17:10:42Z","modified":"2023-01-29T05:01:44Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:44:53.993473Z"}],"nvd":[{"id":"CVE-2020-10257","description":"The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.","status":"published","published":"2020-03-10T00:15:10.757Z","modified":"2026-06-17T02:47:34.837Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94","CWE-862"],"updated_at":"2026-11-02T14:05:55.32877Z"}]}}