ThemeREX Addons WordPress Plugin Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the ThemeREX Addons plugin for WordPress, affecting all versions through 2.33.0. The vulnerability arises in the 'trx_sc_reviews' shortcode, specifically through the 'type' attribute. This issue allows authenticated attackers with contributor-level or higher permissions to include and execute arbitrary files on the server. Exploitation of this vulnerability could lead to the execution of PHP code contained in the included files, potentially bypassing access controls, accessing sensitive data, or executing code in scenarios where PHP files can be uploaded and included.

Impact

Exploitation of this vulnerability could allow for unauthorized file inclusion, execution of arbitrary PHP code on the server, and potential bypass of access controls, access to sensitive information, or execution of uploaded PHP files.

Remediation

Users are advised to update the ThemeREX Addons plugin to version 2.34.0 or a newer patched version.