CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-10257
Critical (9.8) in themerex. EPSS 8.9% chance of exploitation in the next 30 days.
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Severity
- EPSS
- 8.9% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-94, CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- themerex:addons
- themerex:aldo-gutenberg_wordpress_blog_theme
- themerex:amuli
- themerex:blabber
- themerex:bonkozoo_zoo
- themerex:briny-diving_wordpress_theme
- themerex:bugster-pests_control
- themerex:buzz_stone-magazine_\&_blog
- themerex:chainpress
- themerex:chit_club-board_games
- themerex:coinpress-cryptocurrency_magazine_\&_blog_wordpress_theme
- themerex:corredo_sport_event
- themerex:dronex-aerial_photography_services
- themerex:especio-food_gutenberg_theme
- themerex:fc_united-football
- themerex:gloss_blog
- themerex:gridiron
- themerex:hallelujah-church
- themerex:heaven_11-multiskin_property_theme
- themerex:helion-agency_\&portfolio
- themerex:hobo_digital_nomad_blog
- themerex:impacto_patronus_multi-landing
- themerex:justitia-multiskin_lawyer_theme
- themerex:kargo-freight_transport
- themerex:katelyn-gutenberg_wordpress_blog_theme
- themerex:kids_care
- themerex:kratz-digital_agency
- themerex:lingvico-language_learning_school
- themerex:maxify-startup_blog
- themerex:meals_and_wheels-food_truck
- themerex:modern_housewife-housewife_and_family_blog
- themerex:mystik-esoterics
- themerex:nazareth-church
- themerex:nelson-barbershop_\+_tattoo_salon
- themerex:netmix-broadband_\&_telecom
- themerex:ozeum-museum
- themerex:partiso_electioncampaign
- themerex:piqes-creative_startup_\&_agency_wordpress_theme
- themerex:pixefy
- themerex:plumbing-repair\,_building_\&_construction_wordpress_theme
- themerex:prider-pride_fest
- themerex:rare_radio
- themerex:renewal-plastic_surgeon_clinic
- themerex:rhodos-creative_corporate_wordpress_theme
- themerex:right_way
- themerex:rosalinda-vegetarian_\&_health_coach
- themerex:rumble-single_fighter_boxer\,_news\,_gym\,_store
- themerex:samadhi-buddhist
- themerex:savejulia_personal_fundraising_campaign
- themerex:scientia-public_library