{"cve":"CVE-2020-10257","nvd":{"published":"2020-03-10T00:15:10.757","modified":"2026-06-17T02:47:34.837","status":"Modified","description":"The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-94","CWE-862"],"references":["https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/","https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/"],"products":["themerex:addons","themerex:aldo-gutenberg_wordpress_blog_theme","themerex:amuli","themerex:blabber","themerex:bonkozoo_zoo","themerex:briny-diving_wordpress_theme","themerex:bugster-pests_control","themerex:buzz_stone-magazine_\\&_blog","themerex:chainpress","themerex:chit_club-board_games","themerex:coinpress-cryptocurrency_magazine_\\&_blog_wordpress_theme","themerex:corredo_sport_event","themerex:dronex-aerial_photography_services","themerex:especio-food_gutenberg_theme","themerex:fc_united-football","themerex:gloss_blog","themerex:gridiron","themerex:hallelujah-church","themerex:heaven_11-multiskin_property_theme","themerex:helion-agency_\\&portfolio","themerex:hobo_digital_nomad_blog","themerex:impacto_patronus_multi-landing","themerex:justitia-multiskin_lawyer_theme","themerex:kargo-freight_transport","themerex:katelyn-gutenberg_wordpress_blog_theme","themerex:kids_care","themerex:kratz-digital_agency","themerex:lingvico-language_learning_school","themerex:maxify-startup_blog","themerex:meals_and_wheels-food_truck","themerex:modern_housewife-housewife_and_family_blog","themerex:mystik-esoterics","themerex:nazareth-church","themerex:nelson-barbershop_\\+_tattoo_salon","themerex:netmix-broadband_\\&_telecom","themerex:ozeum-museum","themerex:partiso_electioncampaign","themerex:piqes-creative_startup_\\&_agency_wordpress_theme","themerex:pixefy","themerex:plumbing-repair\\,_building_\\&_construction_wordpress_theme","themerex:prider-pride_fest","themerex:rare_radio","themerex:renewal-plastic_surgeon_clinic","themerex:rhodos-creative_corporate_wordpress_theme","themerex:right_way","themerex:rosalinda-vegetarian_\\&_health_coach","themerex:rumble-single_fighter_boxer\\,_news\\,_gym\\,_store","themerex:samadhi-buddhist","themerex:savejulia_personal_fundraising_campaign","themerex:scientia-public_library"],"source":"nvd","synced_at":"2026-10-19T21:02:53.949909883+00:00"},"epss":{"cve":"CVE-2020-10257","score":0.08877,"percentile":0.9522,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}