{"cvss":9.8,"datePublished":"2020-03-09T00:00:00Z","dateUpdated":"2020-03-09T00:00:00Z","description":"The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.","dueDate":"","id":"CVE-2020-10257","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"addons","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"ThemeREX addons Improper Control of Generation of Code","vendor":"ThemeREX"}