The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | trx_addons | unaffected |
|
No data.
No data.
No data.
Subscriptions
No data.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 23 Mar 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448 | |
| Title | ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-03-23T06:00:04.026Z
Reserved: 2026-02-05T13:15:10.756Z
Link: CVE-2026-1969
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-23T06:16:20.257
Modified: 2026-03-23T06:16:20.257
Link: CVE-2026-1969
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.