CVE-2020-10257
📋 TL;DR
CVE-2020-10257 is a critical remote code execution vulnerability in the ThemeREX Addons WordPress plugin. It allows unauthenticated attackers to execute arbitrary PHP code via an unsafe parameter in the REST API endpoint. All WordPress sites using vulnerable versions of the plugin are affected.
💻 Affected Systems
- ThemeREX Addons WordPress Plugin
📦 What is this software?
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Addons by Themerex
Aldo Gutenberg Wordpress Blog Theme by Themerex
View all CVEs affecting Aldo Gutenberg Wordpress Blog Theme →
Amuli by Themerex
Blabber by Themerex
Bonkozoo Zoo by Themerex
Chainpress by Themerex
Coinpress Cryptocurrency Magazine \& Blog Wordpress Theme by Themerex
View all CVEs affecting Coinpress Cryptocurrency Magazine \& Blog Wordpress Theme →
Dronex Aerial Photography Services by Themerex
View all CVEs affecting Dronex Aerial Photography Services →
Gloss Blog by Themerex
Gridiron by Themerex
Heaven 11 Multiskin Property Theme by Themerex
View all CVEs affecting Heaven 11 Multiskin Property Theme →
Justitia Multiskin Lawyer Theme by Themerex
Katelyn Gutenberg Wordpress Blog Theme by Themerex
View all CVEs affecting Katelyn Gutenberg Wordpress Blog Theme →
Kids Care by Themerex
Lingvico Language Learning School by Themerex
Modern Housewife Housewife And Family Blog by Themerex
View all CVEs affecting Modern Housewife Housewife And Family Blog →
Nelson Barbershop \+ Tattoo Salon by Themerex
Ozeum Museum by Themerex
Piqes Creative Startup \& Agency Wordpress Theme by Themerex
View all CVEs affecting Piqes Creative Startup \& Agency Wordpress Theme →
Pixefy by Themerex
Plumbing Repair\, Building \& Construction Wordpress Theme by Themerex
View all CVEs affecting Plumbing Repair\, Building \& Construction Wordpress Theme →
Rare Radio by Themerex
Rhodos Creative Corporate Wordpress Theme by Themerex
View all CVEs affecting Rhodos Creative Corporate Wordpress Theme →
Right Way by Themerex
Rosalinda Vegetarian \& Health Coach by Themerex
View all CVEs affecting Rosalinda Vegetarian \& Health Coach →
Rumble Single Fighter Boxer\, News\, Gym\, Store by Themerex
View all CVEs affecting Rumble Single Fighter Boxer\, News\, Gym\, Store →
Savejulia Personal Fundraising Campaign by Themerex
View all CVEs affecting Savejulia Personal Fundraising Campaign →
Tacticool Shooting Range Wordpress Theme by Themerex
View all CVEs affecting Tacticool Shooting Range Wordpress Theme →
Tantum Rent A Car\, Rent A Bike\, Rent A Scooter Multiskin Theme by Themerex
View all CVEs affecting Tantum Rent A Car\, Rent A Bike\, Rent A Scooter Multiskin Theme →
Tediss Soft Play Area\, Cafe \& Child Care Center by Themerex
View all CVEs affecting Tediss Soft Play Area\, Cafe \& Child Care Center →
Tornados by Themerex
Vapester by Themerex
Vixus Startup \/ Mobile Application by Themerex
View all CVEs affecting Vixus Startup \/ Mobile Application →
Wellspring Water Filter Systems by Themerex
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to install backdoors, steal data, deface websites, or use the server for further attacks.
Likely Case
Website defacement, malware injection, data theft, or cryptocurrency mining malware installation.
If Mitigated
No impact if the vulnerable endpoint is properly restricted or the plugin is updated/disabled.
🎯 Exploit Status
Exploitation is trivial with publicly available proof-of-concept code. The vulnerability was actively exploited in the wild before patching.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2020-03-09 or later
Vendor Advisory: https://themerex.net/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find ThemeREX Addons plugin. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable REST endpoint
allAdd code to functions.php to block access to the vulnerable endpoint
add_filter('rest_endpoints', function($endpoints) { if (isset($endpoints['/trx_addons/v2/get/sc_layout'])) { unset($endpoints['/trx_addons/v2/get/sc_layout']); } return $endpoints; });
Disable plugin
allTemporarily disable ThemeREX Addons plugin until patched
Navigate to WordPress admin → Plugins → Installed Plugins → Deactivate ThemeREX Addons
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests to /trx_addons/v2/get/sc_layout endpoint
- Restrict access to WordPress admin and REST API endpoints using IP whitelisting or authentication
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → ThemeREX Addons → Version. If version date is before 2020-03-09, you are vulnerable.Check Version:
wp plugin list --name=trx-addons --field=version (if WP-CLI installed)Verify Fix Applied:
Verify plugin version is 2020-03-09 or later. Test endpoint access with curl: curl -X POST https://yoursite.com/wp-json/trx_addons/v2/get/sc_layout -d '{"sc":"phpinfo()"}' should return error or no PHP execution.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-json/trx_addons/v2/get/sc_layout
- Unusual PHP execution errors in web server logs
- Suspicious user agents or IPs accessing REST endpoints
Network Indicators:
- POST requests to /trx_addons/v2/get/sc_layout with PHP code in parameters
- Unusual outbound connections from web server after exploitation
SIEM Query:
source="web_logs" AND (url_path="/wp-json/trx_addons/v2/get/sc_layout" OR url_path="/?rest_route=/trx_addons/v2/get/sc_layout")