CVE-2024-13448criticalexplotación observadaCWE-434

CVE-2024-13448: fallo crítico en ThemeREX Addons

ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ThemeREX Addons

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

50Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Actcvss 9.8epss 0.9%
de la publicación al arma
Publicada en NVD28 ene
VulnCheck+461d
The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
ThemeREX · ThemeREX Addons
CVEs relacionadas — ThemeREX Addons

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-0682HIGHThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via ShortcodeEPSS 0.6%CVE-2025-6997MEDIUMThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file FunctionEPSS 0.2%