What is the CVSS score of CVE-2025-68560?

CVE-2025-68560 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

PHP CVE-2025-68560

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-23 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 23, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.10.5.1.

AnalysisAI

Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.

Technical ContextAI

This vulnerability exploits improper input validation on filename parameters used in PHP include or require statements (CWE-98, also known as Remote File Inclusion or RFI when involving external sources, and Local File Inclusion or LFI when confined to local filesystem traversal). The TheGem Elements plugin, which extends Elementor's page building capabilities in WordPress, fails to properly sanitize user-supplied input before using it in file inclusion functions. Attackers can manipulate these parameters to include and execute arbitrary local PHP files or read sensitive files like wp-config.php. The CPE for this WordPress plugin is implicit via Patchstack's taxonomy as a WordPress plugin component affecting the Elementor ecosystem.

Affected ProductsAI

CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin is affected in all versions from the earliest release through version 5.10.5.1. The plugin extends Elementor page builder functionality within WordPress installations. Additional version scope boundaries and exact CPE identification are not provided in the available data; refer to Patchstack's vulnerability database record for confirmation of affected major versions.

RemediationAI

Users of TheGem Theme Elements should immediately upgrade to a version newer than 5.10.5.1 when available from CodexThemes. As no specific patched version is confirmed in the provided data, check the official plugin repository or CodexThemes' website for the latest release. Until a patch is applied, website administrators should restrict access to Elementor page builder interfaces to trusted users only and implement Web Application Firewall (WAF) rules to block PHP include/require parameter tampering. The vulnerability is documented on Patchstack's vulnerability database (referenced in the advisory link); consult that resource for detailed remediation guidance and confirmation of patched versions.