PT-2025-52742 · Codexthemes · Thegem Theme Elements

João Pedro S Alcântara + 1 · Published 2025-12-23 · Updated 2025-12-28 · CVE-2025-68560

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TheGem Theme Elements (for Elementor) versions through 5.10.5.1

Description An issue exists in CodexThemes TheGem Theme Elements (for Elementor) related to improper control of filename for include/require statements, potentially leading to a PHP Remote File Inclusion. This allows for the inclusion of files from remote locations, which could lead to code execution.

Recommendations Update TheGem Theme Elements (for Elementor) to a version later than 5.10.5.1.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-68560

Affected Products

Thegem Theme Elements

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-68560 · Security Note
• https://twitter.com/cracbot/status/2005232318643093995 · Twitter Post
• https://t.me/CVEtracker/40485 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/thegem-elements-elementor/vulnerability/wordpress-thegem-theme-elements-for-elementor-plugin-5-10-5-1-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://vdp.patchstack.com/database/wordpress/plugin/thegem-elements-elementor/vulnerability/wordpress-thegem-theme-elements-for-elementor-plugin-5-10-5-1-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/thegem-elements-elementor/vulnerability/wordpress-thegem-theme-elements-for-elementor-plugin-5-10-5-1-local-file-inclusion-vulnerability?_s_id=cve · Note