CVE-2026-102797— WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability
Quick assessment
Affected
ThemeREX Group ThemeREX Addons
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 ThemeREX Group 的 ThemeREX Addons 插件（trx_addons）中存在服务器端请求伪造（SSRF）漏洞，攻击者可利用该漏洞实现服务器端请求伪造。此问题影响 ThemeREX Addons 从初始版本至 2.46.0 的所有版本。
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-MiddleAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ThemeREX Group | ThemeREX Addons | ≤ 2.46.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102797
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ThemeREX Group | ThemeREX Addons | 0 ~ 2.46.0 | - |
|
II. Public POCs for CVE-2026-102797
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102797
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-102797 (1)
IV. Related Vulnerabilities
Same product: ThemeREX Addons
-
CVE-2026-102798
WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scri -
CVE-2026-97236
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scrip -
CVE-2026-97235
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scrip -
CVE-2026-62105
WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injec -
CVE-2025-60205
WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object In
Same vendor: ThemeREX Group
-
CVE-2026-102798
WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scri -
CVE-2026-39529
WordPress Elementra theme <= 1.0.9 - PHP Object Injection vu -
CVE-2025-60085
WordPress Learnify theme <= 1.15.0 - Local File Inclusion vu -
CVE-2025-58924
WordPress Geya theme <= 1.15 - Local File Inclusion vulnerab
Same weakness: CWE-918
-
CVE-2026-82044
UTMStack < 11.2.16 Server-Side Request Forgery via downloadP -
CVE-2026-82040
UTMStack < 11.2.16 SSRF via IdentityProviderService -
CVE-2026-103958
Server-side request forgery in the tool server and remote ag -
CVE-2026-103957
Server-side request forgery in the OAuth2 discovery handling -
CVE-2020-37278
Weaver e-Bridge Unauthenticated Arbitrary File Read via save
V. Comments for CVE-2026-102797
No comments yet