MEDIUM CWE-434
CVE-2026-1969
ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload
5.3/ 10
CVSS 3.1
Medium severity
0.30%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 23% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Mar 23, 2026
- Updated
- Mar 23, 2026
- First covered
- Jul 11, 2026
- Latest story
- 4 months ago
Summary
The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448
CWE-434Unrestricted Upload of File with Dangerous Type
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityNone
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NAffected products
- Trx Addonsbefore 2.38.5