The plugin has a Local File Inclusion flaw in the trx_sc_reviews shortcode 'type' attribute that allows an authenticated user with contributor-level permission or higher to include arbitrary files, enabling execution of PHP code on the server. This can be used to bypass access controls, exfiltrate data, or gain full code execution if a PHP payload is uploaded and included.

Affects ThemeREX Addons plugin for WordPress, versions 2.33.0 and below. WordPress sites that use these plugin versions are impacted.

The CVSS score of 8.8 indicates high severity, but the EPSS score is less than 1%, suggesting low current exploitation probability. The vulnerability is not listed in CISA KEV. Attack requires authenticated access at contributor level or above and the ability to supply a payload through the shortcode. If the attacker can upload a PHP file, they can include and execute arbitrary code.