The WordPress plugin ThemeREX Addons (trx_addons) contains an AJAX endpoint that accepts file uploads without correctly validating the file type. An attacker can therefore upload any file, including executable scripts. If the file is executed on the server, the attacker gains the ability to run arbitrary code, modify site content, or compromise sensitive data. This flaw is a classic example of arbitrary file upload vulnerability (CWE‑434) and poses a moderate risk to confidentiality, integrity and availability.

The vulnerability affects all installations of ThemeREX Addons that use a version older than 2.38.5. No other products or vendor versions are specifically identified in the advisory. Sites that have not yet updated the plugin are therefore exposed to this risk.

The CVSS v3.1 score of 5.3 reflects moderate severity, while the EPSS probability of less than 1% suggests a low likelihood of exploitation under current threat conditions. The flaw is not listed in the CISA KEV catalog. Attackers can trigger the vulnerability from any internet‑accessible location, as authentication is not required; they only need to construct a POST request to the vulnerable AJAX endpoint and supply a malicious file. Successful exploitation would allow the attacker to execute arbitrary code on the host.