WordPress Plugin Vulnerabilities

ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload

Description

The plugin does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448

Proof of Concept

Affects Plugins

Plugin icon
trx_addons
Fixed in 2.38.5

References

CVE
CVE-2026-1969

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
762530ae-80a5-4ff8-9725-6adab9498c33

Timeline

Publicly Published
2026-03-02 (about 21 days ago)
Added
2026-03-02 (about 20 days ago)
Last Updated
2026-03-02 (about 20 days ago)

Other

Published
Title
Published
2019-06-15
Title
IP Address Blocker < 10.5 - CSRF leading to Arbitrary File Upload
Published
2025-05-08
Title
1 Click WordPress Migration Plugin – 100% FREE for a limited time < 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
Published
2024-04-25
Title
XStore Core <= 5.3.5 - Authenticated (Subscriber+) Limited Arbitrary File Upload
Published
2024-01-30
Title
Contact Form Entries < 1.3.3 - Admin+ Arbitrary File Upload
Published
2025-09-25
Title
WP-DownloadManager < 1.69 - Authenticated (Admin+) Arbitrary File Upload