CVE:CVE-2020-10257
CNNVD:CNNVD-202003-383
WordPress是WordPress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。ThemeREX Addons是使用在其中的一个网站主题插件。
WordPress ThemeREX Addons 2020-03-09之前版本中存在安全漏洞，该漏洞源于/trx_addons/v2/get/sc_layout REST API端点缺少访问控制。攻击者可利用该漏洞执行PHP函数。
solution:Upgrade themerex addons to a higher version than 1.70.3,1.6.67,1.6.66,1.6.65,1.6.62.3,1.6.62.1,1.6.61.2,1.6.61.3,1.6.61.1,1.6.61,1.6.60,1.6.59.3,1.6.59.2,1.6.59.1.1,1.6.59,1.6.58.2,1.6.57.3,1.6.57.4,1.6.57.2,1.6.57,1.6.56,1.6.55.4,1.6.55.7,1.6.55.3,1.6.55.1,1.6.54,1.6.53.1,1.6.53.3,1.6.53.2,1.6.52.2,1.6.52.1,1.6.53,1.6.51.3,1.6.51.1,1.6.50,1.6.50.1,1.0.49.10,1.6.49.8,1.6.49.6,1.6.49.6.2,1.6.49.5,and avoid the version 1.70.3,1.6.67,1.6.66,1.6.65,1.6.62.3,1.6.62.1,1.6.61.2,1.6.61.3,1.6.61.1,1.6.61,1.6.60,1.6.59.3,1.6.59.2,1.6.59.1.1,1.6.59,1.6.58.2,1.6.57.3,1.6.57.4,1.6.57.2,1.6.57,1.6.56,1.6.55.4,1.6.55.7,1.6.55.3,1.6.55.1,1.6.54,1.6.53.1,1.6.53.3,1.6.53.2,1.6.52.2,1.6.52.1,1.6.53,1.6.51.3,1.6.51.1,1.6.50,1.6.50.1,1.0.49.10,1.6.49.8,1.6.49.6,1.6.49.6.2,1.6.49.5; Upgrade themerex ozeum-museum to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex chit_club-board_games to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex yottis-simple_portfolio to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex helion-agency_&portfolio to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex amuli to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex nelson-barbershop_+_tattoo_salon to a higher version than 1.0.1.2001,and avoid the version (,1.0.1.2001); Upgrade themerex hallelujah-church to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex right_way to a higher version than 4.0.1,and avoid the version (,4.0.1); Upgrade themerex prider-pride_fest to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex mystik-esoterics to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex skydiving_and_flying_company to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex dronex-aerial_photography_services to a higher version than 1.1.2001,and avoid the version (,1.1.2001); Upgrade themerex samadhi-buddhist to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex tantum-rent_a_car,_rent_a_bike,_rent_a_scooter_multiskin_theme to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex scientia-public_library to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex blabber to a higher version than 1.5.2009,and avoid the version (,1.5.2009); Upgrade themerex impacto_patronus_multi-landing to a higher version than 1.1.2001,and avoid the version (,1.1.2001); Upgrade themerex rare_radio to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex piqes-creative_startup_&_agency_wordpress_theme to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex kratz-digital_agency to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex pixefy to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex netmix-broadband_&_telecom to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex kids_care to a higher version than 3.0.5,and avoid the version (,3.0.5); Upgrade themerex briny-diving_wordpress_theme to a higher version than 1.2.2000,and avoid the version (,1.2.2000); Upgrade themerex tornados to a higher version than 1.1.2001,and avoid the version (,1.1.2001); Upgrade themerex gridiron to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex yungen-digital/marketing_agency to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex fc_united-football to a higher version than 1.0.7,and avoid the version (,1.0.7); Upgrade themerex bugster-pests_control to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex rumble-single_fighter_boxer,_news,_gym,_store to a higher version than 1.0.4,and avoid the version (,1.0.4); Upgrade themerex tacticool-shooting_range_wordpress_theme to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex coinpress-cryptocurrency_magazine_&_blog_wordpress_theme to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex vihara-ashram,_buddhist to a higher version than 1.1.2001,and avoid the version (,1.1.2001); Upgrade themerex katelyn-gutenberg_wordpress_blog_theme to a higher version than 1.0.4,and avoid the version (,1.0.4); Upgrade themerex heaven_11-multiskin_property_theme to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex especio-food_gutenberg_theme to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex partiso_electioncampaign to a higher version than 1.1.2002,and avoid the version (,1.1.2002); Upgrade themerex kargo-freight_transport to a higher version than 1.1.2004,and avoid the version (,1.1.2004); Upgrade themerex maxify-startup_blog to a higher version than 1.0.4,and avoid the version (,1.0.4); Upgrade themerex lingvico-language_learning_school to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex aldo-gutenberg_wordpress_blog_theme to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex vixus-startup_/_mobile_application to a higher version than 1.0.4,and avoid the version (,1.0.4); Upgrade themerex wellspring_water_filter_systems to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex nazareth-church to a higher version than 1.0.5,and avoid the version (,1.0.5); Upgrade themerex tediss-soft_play_area,_cafe_&_child_care_center to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex yolox-startup_magazine_&_blog_wordpress_theme to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex meals_and_wheels-food_truck to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex rosalinda-vegetarian_&_health_coach to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex vapester to a higher version than 1.1.2001,and avoid the version (,1.1.2001); Upgrade themerex modern_housewife-housewife_and_family_blog to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade themerex chainpress to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex justitia-multiskin_lawyer_theme to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex hobo_digital_nomad_blog to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex rhodos-creative_corporate_wordpress_theme to a higher version than 1.3.2001,and avoid the version (,1.3.2001); Upgrade themerex buzz_stone-magazine_&_blog to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex corredo_sport_event to a higher version than 1.1.2003,and avoid the version (,1.1.2003); Upgrade themerex savejulia_personal_fundraising_campaign to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex bonkozoo_zoo to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex renewal-plastic_surgeon_clinic to a higher version than 1.0.3,and avoid the version (,1.0.3); Upgrade themerex gloss_blog to a higher version than 1.0.1,and avoid the version (,1.0.1); Upgrade themerex plumbing-repair,_building_&_construction_wordpress_theme to a higher version than 3.0.1,and avoid the version (,3.0.1); Upgrade themerex topper_theme_and_skins to a higher version than -