On this page

Atomicorp WAF Research Note: CVE-2020-10257

ThemeREX Addons - Remote Code Execution

CVE Details

Already protected by existing Atomicorp WAF rules
Protection status: Understanding Atomicorp WAF Protection Status
CVE: CVE-2020-10257
Name: ThemeREX Addons - Remote Code Execution
Severity: Critical
CVSS: 9.8 (v3.1) (Critical)
CVSS version: 3.1
CVSS source: N/A
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Confidentiality impact: High
- Integrity impact: High
- Availability impact: High
CWE: CWE-94 — Improper Control of Generation of Code (‘Code Injection’), CWE-862 — Missing Authorization
Related CAPEC attack patterns (via MITRE CWE relationships): CAPEC-242 (opens in a new tab) , CAPEC-35 (opens in a new tab) , CAPEC-665 (opens in a new tab) , CAPEC-77 (opens in a new tab)
Vendor: themerex
Vulnerable products: addons , ozeum-museum , chit club-board games , yottis-simple portfolio , helion-agency &portfolio , amuli , nelson-barbershop + tattoo salon , hallelujah-church , right way , prider-pride fest , mystik-esoterics , skydiving and flying company , dronex-aerial photography services , samadhi-buddhist , tantum-rent a car, rent a bike, rent a scooter multiskin theme , scientia-public library , blabber , impacto patronus multi-landing , rare radio , piqes-creative startup & agency wordpress theme , kratz-digital agency , pixefy , netmix-broadband & telecom , kids care , briny-diving wordpress theme , tornados , gridiron , yungen-digital/marketing agency , fc united-football , bugster-pests control , rumble-single fighter boxer, news, gym, store , tacticool-shooting range wordpress theme , coinpress-cryptocurrency magazine & blog wordpress theme , vihara-ashram, buddhist , katelyn-gutenberg wordpress blog theme , heaven 11-multiskin property theme , especio-food gutenberg theme , partiso electioncampaign , kargo-freight transport , maxify-startup blog , lingvico-language learning school , aldo-gutenberg wordpress blog theme , vixus-startup / mobile application , wellspring water filter systems , nazareth-church , tediss-soft play area, cafe & child care center , yolox-startup magazine & blog wordpress theme , meals and wheels-food truck , rosalinda-vegetarian & health coach , vapester , modern housewife-housewife and family blog , chainpress , justitia-multiskin lawyer theme , hobo digital nomad blog , rhodos-creative corporate wordpress theme , buzz stone-magazine & blog , corredo sport event , savejulia personal fundraising campaign , bonkozoo zoo , renewal-plastic surgeon clinic , gloss blog , plumbing-repair, building & construction wordpress theme , topper theme and skins , themerex
CVE published: 2020-03-10
CVE last modified: 2026-06-17
Affected versions (NVD configurations):
- addons: 1.70.3
- ozeum-museum: < 1.0.2
- chit club-board games: < 1.0.1
- addons: 1.6.67
- yottis-simple portfolio: < 1.0.1
- addons: 1.6.66
- helion-agency &portfolio: < 1.0.3
- amuli: < 1.0.2
- addons: 1.6.65
- nelson-barbershop + tattoo salon: < 1.0.1.2001
- hallelujah-church: < 1.0.1
- right way: < 4.0.1
- prider-pride fest: < 1.0.2
- addons: 1.6.62.3
- mystik-esoterics: < 1.0.1
- skydiving and flying company: < 1.0.1
- addons: 1.6.62.1
- dronex-aerial photography services: < 1.1.2001
- addons: 1.6.61.2
- samadhi-buddhist: < 1.0.1
- addons: 1.6.61.3
- tantum-rent a car, rent a bike, rent a scooter multiskin theme: < 1.0.2
- scientia-public library: < 1.0.1
- blabber: < 1.5.2009
- addons: 1.6.61.1
- impacto patronus multi-landing: < 1.1.2001
- addons: 1.6.61
- rare radio: < 1.0.1
- addons: 1.6.60
- piqes-creative startup & agency wordpress theme: < 1.0.1
- addons: 1.6.59.3
- kratz-digital agency: < 1.0.2
- addons: 1.6.59.2
- pixefy: < 1.0.1
- addons: 1.6.59.1.1
- netmix-broadband & telecom: < 1.0.2
- addons: 1.6.59
- kids care: < 3.0.5
- addons: 1.6.58.2
- briny-diving wordpress theme: < 1.2.2000
- addons: 1.6.57.3
- tornados: < 1.1.2001
- addons: 1.6.57.4
- gridiron: < 1.0.2
- addons: 1.6.57.2
- yungen-digital/marketing agency: < 1.0.1
- fc united-football: < 1.0.7
- bugster-pests control: < 1.0.2
- addons: 1.6.57
- rumble-single fighter boxer, news, gym, store: < 1.0.4
- addons: 1.6.56
- tacticool-shooting range wordpress theme: < 1.0.1
- addons: 1.6.55.4
- coinpress-cryptocurrency magazine & blog wordpress theme: < 1.0.2
- addons: 1.6.55.7
- vihara-ashram, buddhist: < 1.1.2001
- addons: 1.6.55.3
- katelyn-gutenberg wordpress blog theme: < 1.0.4
- addons: 1.6.55.1
- heaven 11-multiskin property theme: < 1.0.2
- addons: 1.6.54
- especio-food gutenberg theme: < 1.0.1
- addons: 1.6.53.1
- partiso electioncampaign: < 1.1.2002
- addons: 1.6.53.3
- kargo-freight transport: < 1.1.2004
- addons: 1.6.53.2
- maxify-startup blog: < 1.0.4
- lingvico-language learning school: < 1.0.3
- aldo-gutenberg wordpress blog theme: < 1.0.2
- addons: 1.6.52.2
- vixus-startup / mobile application: < 1.0.4
- addons: 1.6.52.1
- wellspring water filter systems: < 1.0.3
- nazareth-church: < 1.0.5
- addons: 1.6.53
- tediss-soft play area, cafe & child care center: < 1.0.3
- addons: 1.6.51.3
- yolox-startup magazine & blog wordpress theme: < 1.0.3
- meals and wheels-food truck: < 1.0.3
- addons: 1.6.51.1
- rosalinda-vegetarian & health coach: < 1.0.3
- addons: 1.6.50
- vapester: < 1.1.2001
- modern housewife-housewife and family blog: < 1.0.2
- addons: 1.6.50.1
- chainpress: < 1.0.3
- justitia-multiskin lawyer theme: < 1.0.3
- hobo digital nomad blog: < 1.0.3
- rhodos-creative corporate wordpress theme: < 1.3.2001
- buzz stone-magazine & blog: < 1.0.3
- addons: 1.0.49.10
- corredo sport event: < 1.1.2003
- addons: 1.6.49.8
- savejulia personal fundraising campaign: < 1.0.3
- addons: 1.6.49.6
- bonkozoo zoo: < 1.0.3
- addons: 1.6.49.6.2
- renewal-plastic surgeon clinic: < 1.0.3
- addons: 1.6.49.5
- gloss blog: < 1.0.1
- plumbing-repair, building & construction wordpress theme: < 3.0.1
- topper theme and skins
EPSS: 0.0888; 94.9th percentile (FIRST (opens in a new tab) )
Latest Update: 2026-07-22
Selected Rule IDs observed: 377360
Matching rules: 1; rules with blocking actions: 0
Would-block Rule IDs: N/A

Technical CPE data

This section lists vulnerable CPE matches retained from the NVD configurations. It supplements the readable affected-product information above.

cpe:2.3:a:themerex:addons:1.70.3:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 415D8A2D-344D-4A75-A834-C6C4C68ACF47
cpe:2.3:a:themerex:ozeum-museum:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: 76F58E84-8810-4221-BC84-5B152A53529D
cpe:2.3:a:themerex:chit_club-board_games:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: B9A00971-2A40-476B-BB49-4D0FA36DE6CA
cpe:2.3:a:themerex:addons:1.6.67:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 0F2EF7DE-F1C2-4245-A5EF-7BBD702B76F0
cpe:2.3:a:themerex:yottis-simple_portfolio:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: 7AF13B64-D55F-4D02-9D77-95CF994AE995
cpe:2.3:a:themerex:addons:1.6.66:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 3661314B-3DD1-495E-9EDC-3A01725A06E7
cpe:2.3:a:themerex:helion-agency_\&portfolio:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: EE4A6B17-FB56-4BCB-A725-B8BD0A1031A2
cpe:2.3:a:themerex:amuli:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: CC9A01E6-7BFB-4FC7-B3AA-CC812DBEC186
cpe:2.3:a:themerex:addons:1.6.65:*:*:*:*:wordpress:*:*
- NVD match criteria ID: F96C11A5-9A64-4F0D-A9B8-308C4A06B997
cpe:2.3:a:themerex:nelson-barbershop_\+_tattoo_salon:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1.2001
- NVD match criteria ID: 3A335E4B-84C4-4FC7-BD47-6D939ED5782C
cpe:2.3:a:themerex:hallelujah-church:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: 7700EC98-EB55-420A-B194-B394C5479827
cpe:2.3:a:themerex:right_way:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 4.0.1
- NVD match criteria ID: 150D52DF-FE9F-46CC-AA67-D0F9F9D27593
cpe:2.3:a:themerex:prider-pride_fest:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: 79D33A86-DB23-4903-B241-8A42D290C9DF
cpe:2.3:a:themerex:addons:1.6.62.3:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 7ECD4BD2-C6E4-4B61-B4D1-ABB96C151153
cpe:2.3:a:themerex:mystik-esoterics:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: 3AA23F39-84FE-43DE-80BF-9A0F5A13E630
cpe:2.3:a:themerex:skydiving_and_flying_company:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: 87B005BC-1CBD-47C2-8D99-40F82DE0EDB3
cpe:2.3:a:themerex:addons:1.6.62.1:*:*:*:*:wordpress:*:*
- NVD match criteria ID: DDF94FB5-C3CB-4272-9382-7BD1770C454A
cpe:2.3:a:themerex:dronex-aerial_photography_services:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.1.2001
- NVD match criteria ID: A781A3AB-613E-4FC6-A2F9-9D644261C21C
cpe:2.3:a:themerex:addons:1.6.61.2:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 089C99E9-CB27-4A5B-B5C4-ABCF34619C97
cpe:2.3:a:themerex:samadhi-buddhist:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: EFE13FB9-41A3-4EAC-9E01-13300957BF87
cpe:2.3:a:themerex:addons:1.6.61.3:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 7AE5EF9D-ABDA-4F54-9A61-F2019C2BC859
cpe:2.3:a:themerex:tantum-rent_a_car\,_rent_a_bike\,_rent_a_scooter_multiskin_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: 45A34C98-9240-483F-99D0-C5FDC2AA0D3D
cpe:2.3:a:themerex:scientia-public_library:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: A3EB47EC-7629-4467-8378-A5E3FCBB853C
cpe:2.3:a:themerex:blabber:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.5.2009
- NVD match criteria ID: 0B19EEE4-6E11-4AEF-804C-16277D952B39
cpe:2.3:a:themerex:addons:1.6.61.1:*:*:*:*:wordpress:*:*
- NVD match criteria ID: E3EA645A-993C-42A0-A80B-F0A661D15633
cpe:2.3:a:themerex:impacto_patronus_multi-landing:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.1.2001
- NVD match criteria ID: 6F9A55CA-206F-4A2B-B86E-243D19474DDB
cpe:2.3:a:themerex:addons:1.6.61:*:*:*:*:wordpress:*:*
- NVD match criteria ID: F7C95469-9D20-4591-A0BA-C3965DD36083
cpe:2.3:a:themerex:rare_radio:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: 8ADA9804-F197-47AD-ADEE-616E913834D7
cpe:2.3:a:themerex:addons:1.6.60:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 5E9E0369-067F-4186-9D5D-33CA5EC9C791
cpe:2.3:a:themerex:piqes-creative_startup_\&_agency_wordpress_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: EE320DA3-CC76-499A-A677-F3DA87E0B986
cpe:2.3:a:themerex:addons:1.6.59.3:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 234568F6-471D-4B48-AEEC-503B17C86C5A
cpe:2.3:a:themerex:kratz-digital_agency:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: 23A4FDDE-F120-46F1-ABD7-B82BDAD2A492
cpe:2.3:a:themerex:addons:1.6.59.2:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 1DBF97DA-57D9-439B-B143-660F6A61EB5C
cpe:2.3:a:themerex:pixefy:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: C16B1817-9FBB-4EEE-9E86-3ECDCBB8B504
cpe:2.3:a:themerex:addons:1.6.59.1.1:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 6A4EB921-5FCA-45A2-BFA5-9CD80618EC8A
cpe:2.3:a:themerex:netmix-broadband_\&_telecom:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: CF93FC05-3096-4279-B2BE-8DEF99CC49ED
cpe:2.3:a:themerex:addons:1.6.59:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 3CB9A69F-36AF-4BC8-91B9-662F3D93289B
cpe:2.3:a:themerex:kids_care:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 3.0.5
- NVD match criteria ID: A3AC4B03-2C61-4D67-9C20-3DC523A24B48
cpe:2.3:a:themerex:addons:1.6.58.2:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 9249BF20-B351-4512-9811-9266942265D0
cpe:2.3:a:themerex:briny-diving_wordpress_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.2.2000
- NVD match criteria ID: 4E588690-A2D2-4A98-9C8F-07CC7C9A8C4D
cpe:2.3:a:themerex:addons:1.6.57.3:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 41F85647-F147-4AC8-B218-ECA404225F7D
cpe:2.3:a:themerex:tornados:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.1.2001
- NVD match criteria ID: 04BD29FF-6355-4DBA-9289-D55C01459EE2
cpe:2.3:a:themerex:addons:1.6.57.4:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 1BA29CAB-0BB3-405D-A765-80AD9F96BC79
cpe:2.3:a:themerex:gridiron:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: FBF5DC5A-2B7F-41E4-87B8-E8D7FBC86414
cpe:2.3:a:themerex:addons:1.6.57.2:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 0BFA7BBD-0DD9-4E6D-81E3-F97307046178
cpe:2.3:a:themerex:yungen-digital\/marketing_agency:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: D708AC36-90A1-429E-B57B-5F5623FFF05D
cpe:2.3:a:themerex:fc_united-football:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.7
- NVD match criteria ID: D7EAE9F1-3D4B-4295-BA23-F9236B43FF34
cpe:2.3:a:themerex:bugster-pests_control:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: 2306DD6E-97D4-4138-957A-EB97FBC56575
cpe:2.3:a:themerex:addons:1.6.57:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 72DDDE9D-0318-4E2D-B823-5E8C131A8C6A
cpe:2.3:a:themerex:rumble-single_fighter_boxer\,_news\,_gym\,_store:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.4
- NVD match criteria ID: 65F561FD-ABEF-4A54-8A79-36275DFF41B8
cpe:2.3:a:themerex:addons:1.6.56:*:*:*:*:wordpress:*:*
- NVD match criteria ID: D9D8E72C-E175-4BAF-931D-08BBADCFE8C7
cpe:2.3:a:themerex:tacticool-shooting_range_wordpress_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: F5455FBD-2F66-462A-85E1-317357FC8DC1
cpe:2.3:a:themerex:addons:1.6.55.4:*:*:*:*:wordpress:*:*
- NVD match criteria ID: FF760417-7D3C-4318-A534-AD3BF2F90A34
cpe:2.3:a:themerex:coinpress-cryptocurrency_magazine_\&_blog_wordpress_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: 868125DA-4B87-44C2-92F8-312CC2012B4F
cpe:2.3:a:themerex:addons:1.6.55.7:*:*:*:*:wordpress:*:*
- NVD match criteria ID: A7114AAF-A988-4D9E-8075-B8E09D234835
cpe:2.3:a:themerex:vihara-ashram\,_buddhist:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.1.2001
- NVD match criteria ID: 5BD68932-E838-432F-8473-84B3F272396D
cpe:2.3:a:themerex:addons:1.6.55.3:*:*:*:*:wordpress:*:*
- NVD match criteria ID: EE14B83E-CD6E-45C6-97ED-4DF9C765B8C5
cpe:2.3:a:themerex:katelyn-gutenberg_wordpress_blog_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.4
- NVD match criteria ID: 26CAE12E-D7BA-4670-86C2-5D8E538F3A6C
cpe:2.3:a:themerex:addons:1.6.55.1:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 292EFA6F-4DDD-484E-999E-A931059A98A7
cpe:2.3:a:themerex:heaven_11-multiskin_property_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: 2C9477E5-0E73-49A0-9420-4EA4DD750AD5
cpe:2.3:a:themerex:addons:1.6.54:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 0A95FDC3-F37A-4D19-B252-1B5DCD041D4C
cpe:2.3:a:themerex:especio-food_gutenberg_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: F0E5638A-164E-482B-A19D-032F871F9914
cpe:2.3:a:themerex:addons:1.6.53.1:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 727050AA-319A-472A-BC47-A7C52D3D78A1
cpe:2.3:a:themerex:partiso_electioncampaign:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.1.2002
- NVD match criteria ID: F715FE4B-1C1B-4728-9854-8C67A77B2FE4
cpe:2.3:a:themerex:addons:1.6.53.3:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 7B8B2A0B-A18A-4F61-9E05-5B5A1E887C0A
cpe:2.3:a:themerex:kargo-freight_transport:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.1.2004
- NVD match criteria ID: DF407634-F80B-4FF2-B496-9338319EC333
cpe:2.3:a:themerex:addons:1.6.53.2:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 79C619F5-8F21-4D83-B480-472ABB74D78A
cpe:2.3:a:themerex:maxify-startup_blog:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.4
- NVD match criteria ID: 152E3D37-488D-40EF-8650-55EB0E55D266
cpe:2.3:a:themerex:lingvico-language_learning_school:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: F3E948CD-78E2-45C0-87D1-9912FE3295D2
cpe:2.3:a:themerex:aldo-gutenberg_wordpress_blog_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: 526A096A-DDC6-4BB7-87D4-C30946D5956E
cpe:2.3:a:themerex:addons:1.6.52.2:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 4E05F3AE-0D09-47DF-ACC2-58E656E87FCA
cpe:2.3:a:themerex:vixus-startup_\/_mobile_application:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.4
- NVD match criteria ID: F6431FAE-D3F2-4F0B-8E2E-B3AF958F589F
cpe:2.3:a:themerex:addons:1.6.52.1:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 832709EC-9F72-425E-A091-4BA3B30D44FD
cpe:2.3:a:themerex:wellspring_water_filter_systems:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: 4E370374-4060-459A-905B-55D9A01E7660
cpe:2.3:a:themerex:nazareth-church:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.5
- NVD match criteria ID: 4F6E1F20-427A-4D01-800B-96F64092E968
cpe:2.3:a:themerex:addons:1.6.53:*:*:*:*:wordpress:*:*
- NVD match criteria ID: ED35A9AC-DDEC-49A9-9154-EB9C13B3BC4C
cpe:2.3:a:themerex:tediss-soft_play_area\,_cafe_\&_child_care_center:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: B097B9AD-C06D-474C-BB71-6F3CC6F3EC2F
cpe:2.3:a:themerex:addons:1.6.51.3:*:*:*:*:wordpress:*:*
- NVD match criteria ID: B06D0160-ADC8-4AE7-B35C-64862D850964
cpe:2.3:a:themerex:yolox-startup_magazine_\&_blog_wordpress_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: 868BCA71-CCC3-4617-9747-ACC6E3240E00
cpe:2.3:a:themerex:meals_and_wheels-food_truck:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: D386062B-F308-4ED0-A30C-0B86F57DC623
cpe:2.3:a:themerex:addons:1.6.51.1:*:*:*:*:wordpress:*:*
- NVD match criteria ID: CD6FABBE-A686-4EE2-AFAE-7D78CF3B4064
cpe:2.3:a:themerex:rosalinda-vegetarian_\&_health_coach:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: 5D92C6CD-B6D7-4782-8B43-7856CF11D04F
cpe:2.3:a:themerex:addons:1.6.50:*:*:*:*:wordpress:*:*
- NVD match criteria ID: A40C76BD-DD5E-4546-8D8E-1496069C0B38
cpe:2.3:a:themerex:vapester:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.1.2001
- NVD match criteria ID: 23E53397-A8CB-480F-AE32-2D2092B7E382
cpe:2.3:a:themerex:modern_housewife-housewife_and_family_blog:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.2
- NVD match criteria ID: 78687932-3E1F-4C47-96BA-E0BF25FBFACD
cpe:2.3:a:themerex:addons:1.6.50.1:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 1B364A8C-228A-44A4-80B1-8E471C06493B
cpe:2.3:a:themerex:chainpress:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: F44C865E-FC06-4CFA-848E-80CA3C3A1987
cpe:2.3:a:themerex:justitia-multiskin_lawyer_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: 1F431DFE-C643-4CDA-89D6-25BBBA91491C
cpe:2.3:a:themerex:hobo_digital_nomad_blog:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: 4D25045C-BDF8-4A5C-96A3-7F45CD4A1CDF
cpe:2.3:a:themerex:rhodos-creative_corporate_wordpress_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.3.2001
- NVD match criteria ID: 0D8858EB-787E-45D1-B1C2-5D023840BCCA
cpe:2.3:a:themerex:buzz_stone-magazine_\&_blog:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: A18D53D3-1D92-43A8-AB72-0C971C6A8C51
cpe:2.3:a:themerex:addons:1.0.49.10:*:*:*:*:wordpress:*:*
- NVD match criteria ID: F7EDB5DE-C5E5-4C68-A83C-EF7C6C630163
cpe:2.3:a:themerex:corredo_sport_event:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.1.2003
- NVD match criteria ID: 431FFDA6-254A-4387-9894-CCC5AFA9D573
cpe:2.3:a:themerex:addons:1.6.49.8:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 533F071F-26BB-4978-91E3-97FECD4EECDE
cpe:2.3:a:themerex:savejulia_personal_fundraising_campaign:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: 7159FD8E-6E68-4FC7-AA46-31205226DE0C
cpe:2.3:a:themerex:addons:1.6.49.6:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 310CFAEA-F13F-4B15-8E9A-13AE7CFFEA58
cpe:2.3:a:themerex:bonkozoo_zoo:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: DAA36195-F528-4F08-A0A5-A87C6BD9995A
cpe:2.3:a:themerex:addons:1.6.49.6.2:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 43002470-1B51-44AB-A07E-F7796443987B
cpe:2.3:a:themerex:renewal-plastic_surgeon_clinic:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.3
- NVD match criteria ID: B206FC3A-C47F-4D83-8848-28A1E376AC46
cpe:2.3:a:themerex:addons:1.6.49.5:*:*:*:*:wordpress:*:*
- NVD match criteria ID: D608B893-4F2D-4828-91F8-2E4B597A3C04
cpe:2.3:a:themerex:gloss_blog:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 1.0.1
- NVD match criteria ID: 8A379218-18C2-4F3D-912B-5999628796AA
cpe:2.3:a:themerex:plumbing-repair\,_building_\&_construction_wordpress_theme:*:*:*:*:*:wordpress:*:*
- Version end (exclusive): 3.0.1
- NVD match criteria ID: 469075B3-560A-4EFD-8B81-62A6FFBC5853
cpe:2.3:a:themerex:topper_theme_and_skins:-:*:*:*:*:wordpress:*:*
- NVD match criteria ID: 4ED89805-5F82-40BA-B669-7416602E5938

Vulnerability Description

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.

Recommended Actions

Maintain the observed Atomicorp detections. Keep your Atomicorp commercial rules current and confirm that the selected observed rules (377360 ) have not been locally disabled. Atomicorp commercial rules are enabled by default. If you use Atomic WAF, review the applicable policy and rule settings. These observations are detection-only; review the resulting events and do not assume they block exploitation.
Apply the vendor’s remediation. WAF protection is defense in depth and does not replace upgrading or following the affected vendor’s guidance.
- No specific CNA/vendor solution or workaround is included in the current CVE Record (opens in a new tab) . Review the vendor’s security advisories and supported-release guidance before making changes.
Validate after changes. Confirm rule updates are current, review WAF events for the affected application, and test application behavior after vendor upgrades, mitigations, or local policy changes.

Research Notes

Atomicorp WAF protections are designed around attack techniques and exploit behaviors, allowing existing protections to apply across multiple vulnerabilities without requiring a unique rule for every CVE.

Public Vulnerability References

NVD (opens in a new tab)
CVE Record (opens in a new tab)
Exploit or technical research: https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/ (opens in a new tab)

Test or Research Source

Source: http/cves/2020/CVE-2020-10257.yaml (opens in a new tab)
Tags: cve, cve2020, rce, themerex, unauth, vkev, wordpress, wp, wp-plugin

Research Note Context

This research note documents exploit-technique analysis associated with this vulnerability and references Atomicorp WAF protections observed during engineering review, testing, or validation activities.

Atomicorp security controls are generally designed to identify and mitigate attack techniques and exploit behaviors rather than individual CVE identifiers. As a result, protections developed for one vulnerability may also apply to related attack variants and future vulnerabilities using similar techniques.

Learn More

Atomicorp develops commercially supported security technologies for web applications, servers, endpoints, workloads, and legacy enterprise platforms.

Organizations interested in protecting systems against exploit techniques associated with vulnerabilities such as this one can learn more about:

Atomic ModSecurity Rules: commercially maintained WAF rules for ModSecurity deployments, including protections for web attacks, bots, scanners, malware, exploitation attempts, and emerging vulnerability classes.
Atomic WAF: an enterprise web application firewall with Atomicorp rules, centralized management, reporting, authentication controls, and operational tooling.
Atomic ModSecurity Integrator: a special licensing option for MSPs, MSSPs, OEMs, VARs, reverse proxy providers, and other integrators who want to incorporate Atomicorp ModSecurity rule technology into their own products or services.
Atomic OSSEC: an enterprise OSSEC-based intrusion detection, compliance, and security monitoring platform.
Atomic Protector: workload protection for Linux, web, cloud, data center, and hybrid environments.

For additional information, product evaluations, or technical discussions, visit https://www.atomicorp.com/ or https://modsecurity.io/ (opens in a new tab) .