CVE-2020-10257

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.

• themerex addons 1.70.3 • themerex ozeum-museum (< 1.0.2) • themerex chit club-board games (< 1.0.1) • themerex addons 1.6.67 • themerex yottis-simple portfolio (< 1.0.1) • themerex addons 1.6.66 • themerex helion-agency \&portfolio (< 1.0.3) • themerex amuli (< 1.0.2) • themerex addons 1.6.65 • themerex nelson-barbershop \+ tattoo salon (< 1.0.1.2001) • themerex hallelujah-church (< 1.0.1) • themerex right way (< 4.0.1) • themerex prider-pride fest (< 1.0.2) • themerex addons 1.6.62.3 • themerex mystik-esoterics (< 1.0.1) • themerex skydiving and flying company (< 1.0.1) • themerex addons 1.6.62.1 • themerex dronex-aerial photography services (< 1.1.2001) • themerex addons 1.6.61.2 • themerex samadhi-buddhist (< 1.0.1) • themerex addons 1.6.61.3 • themerex tantum-rent a car\, rent a bike\, rent a scooter multiskin theme (< 1.0.2) • themerex scientia-public library (< 1.0.1) • themerex blabber (< 1.5.2009) • themerex addons 1.6.61.1 • themerex impacto patronus multi-landing (< 1.1.2001) • themerex addons 1.6.61 • themerex rare radio (< 1.0.1) • themerex addons 1.6.60 • themerex piqes-creative startup \& agency wordpress theme (< 1.0.1) • themerex addons 1.6.59.3 • themerex kratz-digital agency (< 1.0.2) • themerex addons 1.6.59.2 • themerex pixefy (< 1.0.1) • themerex addons 1.6.59.1.1 • themerex netmix-broadband \& telecom (< 1.0.2) • themerex addons 1.6.59 • themerex kids care (< 3.0.5) • themerex addons 1.6.58.2 • themerex briny-diving wordpress theme (< 1.2.2000) • themerex addons 1.6.57.3 • themerex tornados (< 1.1.2001) • themerex addons 1.6.57.4 • themerex gridiron (< 1.0.2) • themerex addons 1.6.57.2 • themerex yungen-digital\/marketing agency (< 1.0.1) • themerex fc united-football (< 1.0.7) • themerex bugster-pests control (< 1.0.2) • themerex addons 1.6.57 • themerex rumble-single fighter boxer\, news\, gym\, store (< 1.0.4) • themerex addons 1.6.56 • themerex tacticool-shooting range wordpress theme (< 1.0.1) • themerex addons 1.6.55.4 • themerex coinpress-cryptocurrency magazine \& blog wordpress theme (< 1.0.2) • themerex addons 1.6.55.7 • themerex vihara-ashram\, buddhist (< 1.1.2001) • themerex addons 1.6.55.3 • themerex katelyn-gutenberg wordpress blog theme (< 1.0.4) • themerex addons 1.6.55.1 • themerex heaven 11-multiskin property theme (< 1.0.2) … and 43 more