What is the CVSS score of CVE-2025-62045?

CVE-2025-62045 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of TheGem Theme Elements are affected by CVE-2025-62045?

TheGem Theme Elements plugin for WPBakery (versions ≤5.10.5.1) contains a local file inclusion vulnerability that could allow remote attackers to execute arbitrary PHP code on WordPress sites.

How to fix or mitigate CVE-2025-62045?

Within 24 hours: Identify all WordPress installations using TheGem Theme Elements plugin ≤5.10.5.1 via plugin inventory audit. Within 7 days: Disable or remove the vulnerable plugin pending vendor update; if business-critical, implement Web Application Firewall rules blocking suspicious file path parameters to the affected plugin endpoints. Within 30 days: Monitor vendor advisories for patch release to version >5.10.5.1 and apply immediately upon availability.

TheGem Theme Elements CVE-2025-62045

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:26 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.10.5.1.

AnalysisAI

Local file inclusion in TheGem Theme Elements (for WPBakery) plugin versions ≤5.10.5.1 allows remote attackers to include and execute arbitrary PHP files without authentication. Despite the high CVSS 8.1 score and network attack vector, the 'AC:H' (high complexity) rating and extremely low EPSS (0.05%, 16th percentile) indicate this requires specific conditions to exploit. No active exploitation has been confirmed - CISA KEV does not list this vulnerability, and EPSS data suggests minimal real-world targeting. The vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98), a common WordPress plugin weakness.

Technical ContextAI

This vulnerability exploits CWE-98 (PHP Remote File Inclusion) in the TheGem Theme Elements plugin, a WPBakery Page Builder extension for WordPress. The plugin fails to properly sanitize user-controlled input used in PHP include() or require() statements, allowing attackers to manipulate file paths. While classified as 'PHP Remote File Inclusion' in the CVE title, Patchstack categorizes this as local file inclusion (LFI), suggesting the vulnerability allows inclusion of files already present on the server rather than external URLs. WPBakery-dependent plugins frequently process shortcode parameters without adequate validation, creating opportunities for path traversal attacks. The affected component processes template or configuration file paths, likely through WordPress shortcode handlers or AJAX endpoints exposed by the plugin.

Affected ProductsAI

TheGem Theme Elements (for WPBakery) plugin for WordPress, all versions from unknown starting point through version 5.10.5.1. The plugin is a companion to the TheGem WordPress theme and extends WPBakery Page Builder functionality. CPE or official vendor identifiers are not provided in available data. The Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/thegem-elements/vulnerability/wordpress-thegem-theme-elements-for-wpbakery-plugin-5-10-5-1-local-file-inclusion-vulnerability serves as the primary reference, though the URL does not confirm whether a patched version has been released by CodexThemes.

RemediationAI

Upgrade TheGem Theme Elements plugin to a version newer than 5.10.5.1 if available through the WordPress plugin repository or CodexThemes vendor channels. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/thegem-elements/vulnerability/wordpress-thegem-theme-elements-for-wpbakery-plugin-5-10-5-1-local-file-inclusion-vulnerability for patch availability confirmation, as no vendor-released fix version is independently confirmed from the provided data. If no patch is available or upgrade is delayed, implement compensating controls: restrict WordPress admin and editor roles to trusted users only (reduces exposure to authenticated contexts if plugin features require login despite PR:N vector), disable or remove the TheGem Elements plugin entirely if WPBakery page builder features are not business-critical (eliminates attack surface), deploy web application firewall rules blocking suspicious file path patterns in POST/GET parameters targeting plugin endpoints (e.g., '../', 'php://filter', null bytes), and monitor WordPress access logs for anomalous requests to /wp-admin/admin-ajax.php or plugin-specific endpoints with file path manipulation attempts. Note that WAF rules may cause false positives with legitimate page builder operations and require testing before production deployment.