Critical · published January 28, 2025
🚨 The ThemeREX Addons plugin for WordPress has a critical flaw that lets attackers upload any file they want — no authentication needed! 🔥 This is like having a front desk at a hotel that doesn’t check IDs — anyone can waltz in and drop off any package, including dangerous ones, without question. 🏨 If exploited, an attacker could upload malicious files that might lead to remote code execution, potentially compromising the entire site. Imagine a hacker sneaking in and commandeering the controls of your site, accessing sensitive data and even taking it offline. This could be absolutely devastating for any site owner!
This is like having a front desk at a hotel that doesn’t check IDs — anyone can waltz in and drop off any package, including dangerous ones, without question. 🏨 The vulnerability arises from a lack of file type validation in the 'trx_addons_uploads_save_data' function, allowing unauthorized file uploads on servers running all versions of the plugin up to and including 2.32.3.
If exploited, an attacker could upload malicious files that might lead to remote code execution, potentially compromising the entire site. Imagine a hacker sneaking in and commandeering the controls of your site, accessing sensitive data and even taking it offline. This could be absolutely devastating for any site owner! To secure your site, immediately update the ThemeREX Addons plugin to the latest version. Additionally, review your file upload handling and implement strong validation checks to ensure only allowed file types are uploaded. Don't wait — this is critical! You've got this! By following these steps, you can turn your site into a fortress! 🛡️