The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-03-09T23:41:34

Updated: 2024-08-04T10:58:40.181Z

Reserved: 2020-03-09T00:00:00

Link: CVE-2020-10257

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-03-10T00:15:10.757

Modified: 2024-11-21T04:55:05.053

Link: CVE-2020-10257

cve-icon Redhat

No data.