CVE-2024-13448
Published: 28 January 2025
Summary
CVE-2024-13448 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Themerex Addons. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads because the trx_addons_uploads_save_data function lacks file type validation in all versions through 2.32.3. This flaw, assigned CWE-434, permits unauthenticated remote attackers to place arbitrary files on the server and carries a CVSS 3.1 score of 9.8.
An unauthenticated attacker can send a crafted request to the affected function and upload executable files, which may result in remote code execution on the host server. The vulnerability affects any site using the plugin, regardless of whether the Qwery theme listed in the references is active.
EPSS for the CVE rose from lower values after disclosure to a peak of 0.0828 on 2026-03-08 before receding to the current 0.0302, indicating a period of increased exploitation interest. Details are available in the Wordfence threat intelligence entry and the referenced ThemeForest item page.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51607
Vulnerability details
The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload arbitrary…
more
files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary unauthenticated file upload in public-facing WordPress plugin directly enables web shell deployment (T1505.003) via ingress tool transfer (T1105) after exploiting the exposed application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires patching the vulnerable ThemeREX Addons plugin up to version 2.32.3 to fix the missing file type validation in trx_addons_uploads_save_data.
Information input validation enforces file type checking on uploads, directly addressing the unrestricted arbitrary file upload vulnerability.
Malicious code protection scans uploaded files for dangerous types and blocks execution, mitigating potential remote code execution from arbitrary uploads.