9.8

CVE-2020-10257

Exploit

ThemeREX Addons (Various Versions) - Missing Authorization

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Mögliche Gegenmaßnahme
ThemeREX Addons: Update to one of the following versions, or a newer patched version: 1.6.49.10, 1.6.49.6, 1.6.49.6.3, 1.6.49.7, 1.6.50.2, 1.6.51.4, 1.6.52.3, 1.6.53.4, 1.6.54.1, 1.6.55.8, 1.6.56.1, 1.6.57.4, 1.6.58.3, 1.6.59.1.2, 1.6.59.4, 1.6.60.1, 1.6.61.1.1, 1.6.61.2.1, 1.6.62.4, 1.6.65.1, 1.6.66.1, 1.6.67.1, 1.70.3.1
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Themerex ≫ Addons Version 1.70.3 SwPlatform wordpress
Themerex ≫ Ozeum-museum SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.70.3 SwPlatform wordpress
Themerex ≫ Chit Club-board Games SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.67 SwPlatform wordpress
Themerex ≫ Yottis-simple Portfolio SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.66 SwPlatform wordpress
Themerex ≫ Helion-agency &portfolio SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.66 SwPlatform wordpress
Themerex ≫ Amuli SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.6.65 SwPlatform wordpress
Themerex ≫ Nelson-barbershop + Tattoo Salon SwPlatform wordpress Version < 1.0.1.2001
Themerex ≫ Addons Version 1.6.65 SwPlatform wordpress
Themerex ≫ Hallelujah-church SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.65 SwPlatform wordpress
Themerex ≫ Right Way SwPlatform wordpress Version < 4.0.1
Themerex ≫ Addons Version 1.6.65 SwPlatform wordpress
Themerex ≫ Prider-pride Fest SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.6.62.3 SwPlatform wordpress
Themerex ≫ Mystik-esoterics SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.62.3 SwPlatform wordpress
Themerex ≫ Skydiving And Flying Company SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.62.1 SwPlatform wordpress
Themerex ≫ Dronex-aerial Photography Services SwPlatform wordpress Version < 1.1.2001
Themerex ≫ Addons Version 1.6.61.2 SwPlatform wordpress
Themerex ≫ Samadhi-buddhist SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.61.3 SwPlatform wordpress
Themerex ≫ Addons Version 1.6.61.2 SwPlatform wordpress
Themerex ≫ Scientia-public Library SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.61.2 SwPlatform wordpress
Themerex ≫ Blabber SwPlatform wordpress Version < 1.5.2009
Themerex ≫ Addons Version 1.6.61.1 SwPlatform wordpress
Themerex ≫ Impacto Patronus Multi-landing SwPlatform wordpress Version < 1.1.2001
Themerex ≫ Addons Version 1.6.61 SwPlatform wordpress
Themerex ≫ Rare Radio SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.60 SwPlatform wordpress
Themerex ≫ Piqes-creative Startup & Agency Wordpress Theme SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.59.3 SwPlatform wordpress
Themerex ≫ Kratz-digital Agency SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.6.59.2 SwPlatform wordpress
Themerex ≫ Pixefy SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.59.1.1 SwPlatform wordpress
Themerex ≫ Netmix-broadband & Telecom SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.6.59 SwPlatform wordpress
Themerex ≫ Kids Care SwPlatform wordpress Version < 3.0.5
Themerex ≫ Addons Version 1.6.58.2 SwPlatform wordpress
Themerex ≫ Briny-diving Wordpress Theme SwPlatform wordpress Version < 1.2.2000
Themerex ≫ Addons Version 1.6.57.3 SwPlatform wordpress
Themerex ≫ Tornados SwPlatform wordpress Version < 1.1.2001
Themerex ≫ Addons Version 1.6.57.4 SwPlatform wordpress
Themerex ≫ Gridiron SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.6.57.2 SwPlatform wordpress
Themerex ≫ Yungen-digital/marketing Agency SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.57.3 SwPlatform wordpress
Themerex ≫ Fc United-football SwPlatform wordpress Version < 1.0.7
Themerex ≫ Addons Version 1.6.57.2 SwPlatform wordpress
Themerex ≫ Bugster-pests Control SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.6.57 SwPlatform wordpress
Themerex ≫ Rumble-single Fighter Boxer, News, Gym, Store SwPlatform wordpress Version < 1.0.4
Themerex ≫ Addons Version 1.6.56 SwPlatform wordpress
Themerex ≫ Tacticool-shooting Range Wordpress Theme SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.55.4 SwPlatform wordpress
Themerex ≫ Coinpress-cryptocurrency Magazine & Blog Wordpress Theme SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.6.55.7 SwPlatform wordpress
Themerex ≫ Vihara-ashram, Buddhist SwPlatform wordpress Version < 1.1.2001
Themerex ≫ Addons Version 1.6.55.3 SwPlatform wordpress
Themerex ≫ Katelyn-gutenberg Wordpress Blog Theme SwPlatform wordpress Version < 1.0.4
Themerex ≫ Addons Version 1.6.55.1 SwPlatform wordpress
Themerex ≫ Heaven 11-multiskin Property Theme SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.6.54 SwPlatform wordpress
Themerex ≫ Especio-food Gutenberg Theme SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.53.1 SwPlatform wordpress
Themerex ≫ Partiso Electioncampaign SwPlatform wordpress Version < 1.1.2002
Themerex ≫ Addons Version 1.6.53.3 SwPlatform wordpress
Themerex ≫ Kargo-freight Transport SwPlatform wordpress Version < 1.1.2004
Themerex ≫ Addons Version 1.6.53.2 SwPlatform wordpress
Themerex ≫ Maxify-startup Blog SwPlatform wordpress Version < 1.0.4
Themerex ≫ Addons Version 1.6.53.1 SwPlatform wordpress
Themerex ≫ Lingvico-language Learning School SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.53.2 SwPlatform wordpress
Themerex ≫ Aldo-gutenberg Wordpress Blog Theme SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.6.52.2 SwPlatform wordpress
Themerex ≫ Vixus-startup / Mobile Application SwPlatform wordpress Version < 1.0.4
Themerex ≫ Addons Version 1.6.52.1 SwPlatform wordpress
Themerex ≫ Wellspring Water Filter Systems SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.52.1 SwPlatform wordpress
Themerex ≫ Nazareth-church SwPlatform wordpress Version < 1.0.5
Themerex ≫ Addons Version 1.6.53 SwPlatform wordpress
Themerex ≫ Tediss-soft Play Area, Cafe & Child Care Center SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.51.3 SwPlatform wordpress
Themerex ≫ Yolox-startup Magazine & Blog Wordpress Theme SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.51.3 SwPlatform wordpress
Themerex ≫ Meals And Wheels-food Truck SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.51.1 SwPlatform wordpress
Themerex ≫ Rosalinda-vegetarian & Health Coach SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.50 SwPlatform wordpress
Themerex ≫ Vapester SwPlatform wordpress Version < 1.1.2001
Themerex ≫ Addons Version 1.6.50 SwPlatform wordpress
Themerex ≫ Modern Housewife-housewife And Family Blog SwPlatform wordpress Version < 1.0.2
Themerex ≫ Addons Version 1.6.50.1 SwPlatform wordpress
Themerex ≫ Chainpress SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.51.1 SwPlatform wordpress
Themerex ≫ Justitia-multiskin Lawyer Theme SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.50 SwPlatform wordpress
Themerex ≫ Hobo Digital Nomad Blog SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.50.1 SwPlatform wordpress
Themerex ≫ Rhodos-creative Corporate Wordpress Theme SwPlatform wordpress Version < 1.3.2001
Themerex ≫ Addons Version 1.6.50 SwPlatform wordpress
Themerex ≫ Buzz Stone-magazine & Blog SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.0.49.10 SwPlatform wordpress
Themerex ≫ Corredo Sport Event SwPlatform wordpress Version < 1.1.2003
Themerex ≫ Addons Version 1.6.49.8 SwPlatform wordpress
Themerex ≫ Savejulia Personal Fundraising Campaign SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.49.6 SwPlatform wordpress
Themerex ≫ Bonkozoo Zoo SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.49.6.2 SwPlatform wordpress
Themerex ≫ Renewal-plastic Surgeon Clinic SwPlatform wordpress Version < 1.0.3
Themerex ≫ Addons Version 1.6.49.5 SwPlatform wordpress
Themerex ≫ Gloss Blog SwPlatform wordpress Version < 1.0.1
Themerex ≫ Addons Version 1.6.58.2 SwPlatform wordpress
Themerex ≫ Plumbing-repair, Building & Construction Wordpress Theme SwPlatform wordpress Version < 3.0.1
Themerex ≫ Addons Version 1.6.61.2 SwPlatform wordpress
Themerex ≫ Topper Theme And Skins Version - SwPlatform wordpress
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt ThemeREX Addons
Version [*, 1.6.49.6)
Version [1.6.49.6.2, 1.6.49.6.3)
Version [1.6.49.8, 1.6.49.9)
Version [1.6.50, 1.6.50.2)
Version [1.6.51, 1.6.51.4)
Version [1.6.52, 1.6.52.3)
Version [1.6.53, 1.6.53.4)
Version [1.6.54, 1.6.54.1)
Version [1.6.55, 1.6.55.8)
Version [1.6.56, 1.6.56.1)
Version [1.6.57, 1.6.57.4)
Version [1.6.58.2, 1.6.58.3)
Version 1.6.59
Version 1.6.59.1
Version [1.6.59.1.1, 1.6.59.1.2)
Version [1.6.59.2, 1.6.59.4)
Version [1.6.60, 1.6.60.1)
Version 1.6.61
Version 1.6.61.1
Version [1.6.61.1.0, 1.6.61.1.1)
Version [1.6.61.2, 1.6.61.2.1)
Version [1.6.65, 1.6.65.1)
Version [1.6.66, 1.6.66.1)
Version [1.6.67, 1.6.67.1)
Version 1.70.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 8.88% 0.946
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
MITRE 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/1a14b674-620e-4247-a200-92d9f23acbca
Third Party Advisory