{"id":"CVE-2026-1969","published":"2026-03-23T06:00:04Z","modified":"2026-03-23T13:25:48Z","title":"ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload","vendor":"Unknown","product":"trx_addons","tier":"core","eol":null,"affectedVersions":[{"vendor":"Unknown","product":"trx_addons","versions":["< 2.38.5"]}],"description":{"text":"The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00297,"percentile":0.22466,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-04-30","exploitedFirstSeen":"2026-04-30","ransomware":false,"evidence":[{"url":"https://patchstack.com/database/wordpress/plugin/trx_addons/vulnerability/wordpress-themerex-addons-plugin-2-38-5-unauthenticated-arbitrary-file-upload-vulnerability","date":"2026-04-30"},{"url":"https://ctrlaltintel.com/research/Wordpress/","date":"2026-06-23"},{"url":"https://socradar.io/blog/wp-shellstorm-expose-1-4m-wordpress-sites/","date":"2026-07-09"},{"url":"https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms","date":"2026-07-09"},{"url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape","date":"2026-08-07"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"https://wpscan.com/vulnerability/762530ae-80a5-4ff8-9725-6adab9498c33/","tags":["exploit","vdb-entry","technical-description"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-14361","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14361","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://wpscan.com/vulnerability/762530ae-80a5-4ff8-9725-6adab9498c33/"],"flow":[],"timeline":[{"date":"2026-03-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-1969","provenance":"source"},{"date":"2026-04-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://patchstack.com/database/wordpress/plugin/trx_addons/vulnerability/wordpress-themerex-addons-plugin-2-38-5-unauthenticated-arbitrary-file-upload-vulnerability","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":53.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 185 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":4.49,"detail":"percentile 0.2247"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-themerex-addons-cve-2024-13448","parents":[{"from":"CVE-2024-13448","to":"CVE-2026-1969","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This is due to an incorrect fix of CVE-2024-13448","from":"CVE.org","in":"CVE-2026-1969"}]}]}}