Local File Inclusion Vulnerability in ThemeREX Addons Plugin for WordPress

CVE-2025-0682

Summary

The ThemeREX Addons plugin for WordPress suffers from a Local File Inclusion vulnerability that impacts all versions up to and including 2.33.0. This issue arises through the 'trx_sc_reviews' shortcode where the 'type' attribute can be manipulated by authenticated attackers with contributor-level permissions or higher. This manipulation allows attackers to include and execute arbitrary files on the web server, potentially leading to unauthorized access, exposure of sensitive information, and execution of arbitrary PHP code. As a result, effective access controls can be bypassed, posing significant risks to the integrity and security of affected WordPress installations.

References