CVE-2024-13448
📋 TL;DR
The ThemeREX Addons WordPress plugin allows unauthenticated attackers to upload arbitrary files due to missing file type validation. This vulnerability affects all versions up to 2.32.3 and can lead to remote code execution on vulnerable WordPress sites.
💻 Affected Systems
- ThemeREX Addons WordPress Plugin
📦 What is this software?
Addons by Themerex
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via remote code execution, allowing attackers to install malware, steal data, or use the server for further attacks.
Likely Case
Attackers upload web shells to gain persistent access, deface websites, or install cryptocurrency miners.
If Mitigated
File uploads blocked or restricted, preventing code execution but potentially allowing denial of service through disk space consumption.
🎯 Exploit Status
Simple HTTP POST request with malicious file upload. Public exploit code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.32.4 or later
Vendor Advisory: https://themeforest.net/item/qwery-multipurpose-business-wordpress-theme/29678687
Restart Required: No
Instructions:
1. Update ThemeREX Addons plugin to version 2.32.4 or later via WordPress admin panel. 2. Verify update completed successfully. 3. Test file upload functionality.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable ThemeREX Addons plugin until patched
wp plugin deactivate trx_addons
Web Application Firewall Rule
allBlock requests to vulnerable endpoint
Block POST requests to /wp-admin/admin-ajax.php with action=trx_addons_uploads_save_data
🧯 If You Can't Patch
- Implement strict file upload restrictions at web server level (e.g., .htaccess rules blocking PHP execution in uploads directory)
- Deploy web application firewall with specific rules blocking the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for ThemeREX Addons plugin version. If version is 2.32.3 or lower, system is vulnerable.Check Version:
wp plugin get trx_addons --field=versionVerify Fix Applied:
Confirm plugin version is 2.32.4 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /wp-admin/admin-ajax.php with action=trx_addons_uploads_save_data
- Unusual file uploads to wp-content/uploads/trx_addons directory
- PHP file execution from uploads directory
Network Indicators:
- HTTP POST requests with file uploads to vulnerable endpoint from unusual IP addresses
SIEM Query:
source="web_logs" AND uri_path="/wp-admin/admin-ajax.php" AND post_data="action=trx_addons_uploads_save_data"