CVE-2026-102797 describes an SSRF vulnerability in the ThemeREX Addons plugin (trx_addons) for WordPress, affecting all versions up to and including 2.46.0. The flaw allows an attacker with low privileges to cause the server to make crafted requests to internal or external resources. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, with scope changed, and impacts on confidentiality and integrity but not availability.

An attacker with low privileges can exploit this SSRF vulnerability to make the server perform unauthorized requests, potentially accessing internal resources or sensitive information. The impact includes limited confidentiality and integrity loss but does not affect system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and apply any official patches once available. Until then, restricting plugin usage to trusted users and limiting server outbound requests may reduce risk.