CVE-2026-1969

Think of trx_addons like a staff member who is supposed to check the type of files being handed in. In this case, the check is weak, and an outsider who doesn’t need to log in can upload files anyway. Attackers commonly use that to plant a hidden “webshell,” which can later be used to take control of the website.

This matters if you run the trx_addons WordPress plugin on your site and it’s on a version before 2.38.5. Because the upload does not require login, outsiders can attempt it directly over the network if they can reach the vulnerable site. This is especially concerning given reports of large-scale scanning for webshell-style backdoors.

This is RED because malicious actors are actively scanning for ways to deploy webshells at scale, and this plugin flaw enables the key step: uploading files without authentication. If your site is reachable and you’re using a vulnerable version, attackers can automate attempts quickly and leave a backdoor for later.

1. Confirm exposure

   • In WordPress, go to Plugins and find “trx_addons.” Record the exact version.
   • Treat any version before 2.38.5 as affected.

2. Upgrade to the fixed version

   • Upgrade trx_addons to 2.38.5.
   • If you maintain staging environments, deploy to staging first to confirm compatibility, then roll to production.

3. If you can’t patch immediately (temporary containment)

   • Disable trx_addons until you can upgrade.
   • Check for suspicious files in common upload/write locations (for example, directories under WordPress content uploads) and remove anything that looks unexpected or recently created.
   • Ensure any file-upload features elsewhere aren’t being abused while you investigate.

4. Hunt for signs of compromise after patching

   • Review server logs and WordPress request logs for unusual activity around the time of any alerts (especially repeated unauthenticated requests targeting plugin AJAX endpoints).
   • Look for newly created executable/script files within web-accessible areas.
   • If you find a webshell or other suspicious file, remove it and treat the site as potentially compromised (reset credentials, rotate secrets, and consider a fuller incident response).

5. What to monitor going forward

   • Spikes in 404/POST/AJAX errors and repeated unauthenticated requests to trx_addons-related endpoints.
   • New file creation events in web-accessible directories.

CISA KEV status: not listed in CISA KEV (so urgency is driven by reported exploitation/scanning activity rather than a KEV inclusion).

Severity is assessed as medium by the provided score, but the impact can be high in practice because the flaw is “unauthenticated arbitrary file upload.” The weakness is CWE-434 (unrestricted file upload) in the trx_addons WordPress plugin, triggered via an AJAX action where file type validation is incorrect. Attackers can upload arbitrary files without authentication and without user interaction.

Exploitation status: press reporting indicates active, large-scale scanning (WP-SHELLSTORM) for deploying webshell backdoors at scale; CISA KEV does not list this CVE.

Fix: versions before 2.38.5 are affected; 2.38.5 is the fixed version.