Unauthenticated Arbitrary File Upload in ThemeREX Addons for WordPress

The primary impact is unauthenticated remote compromise of the affected WordPress site through arbitrary file upload. If the uploaded file can be executed by the web server, an attacker can obtain remote code execution in the security context of the web application, deploy webshells, modify site content, steal application data, create persistence, and use the host as a staging point for further malicious activity. Even where direct execution is constrained, arbitrary file upload can still enable defacement, storage of malicious content, or follow-on exploitation depending on server configuration and plugin behavior.

If immediate patching is not possible, reduce exposure by disabling the vulnerable plugin or restricting access to the affected AJAX functionality through compensating controls such as a web application firewall, reverse proxy filtering, or temporary site-level access restrictions. Harden the WordPress environment so that uploaded content cannot be executed as server-side code, minimize write permissions in web-accessible directories, and monitor for anomalous file creation and suspicious requests to AJAX endpoints. Because this vulnerability has been reported as exploited in the wild, defenders should also perform threat hunting for signs of prior compromise.

Upgrade ThemeREX Addons (trx_addons) to version 2.38.5 or later. Because the issue resulted from an incorrect prior fix, organizations should verify that all affected instances are fully updated rather than assuming earlier remediation for CVE-2024-13448 is sufficient. After patching, review the WordPress installation and writable web-accessible directories for unauthorized uploaded files, webshells, and other persistence mechanisms, and remove any malicious artifacts discovered during incident response.