CVE-2025-68560
Lifecycle Timeline
2Tags
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.10.5.1.
Analysis
Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.
Technical Context
This vulnerability exploits improper input validation on filename parameters used in PHP include or require statements (CWE-98, also known as Remote File Inclusion or RFI when involving external sources, and Local File Inclusion or LFI when confined to local filesystem traversal). The TheGem Elements plugin, which extends Elementor's page building capabilities in WordPress, fails to properly sanitize user-supplied input before using it in file inclusion functions. Attackers can manipulate these parameters to include and execute arbitrary local PHP files or read sensitive files like wp-config.php. The CPE for this WordPress plugin is implicit via Patchstack's taxonomy as a WordPress plugin component affecting the Elementor ecosystem.
Affected Products
CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin is affected in all versions from the earliest release through version 5.10.5.1. The plugin extends Elementor page builder functionality within WordPress installations. Additional version scope boundaries and exact CPE identification are not provided in the available data; refer to Patchstack's vulnerability database record for confirmation of affected major versions.
Remediation
Users of TheGem Theme Elements should immediately upgrade to a version newer than 5.10.5.1 when available from CodexThemes. As no specific patched version is confirmed in the provided data, check the official plugin repository or CodexThemes' website for the latest release. Until a patch is applied, website administrators should restrict access to Elementor page builder interfaces to trusted users only and implement Web Application Firewall (WAF) rules to block PHP include/require parameter tampering. The vulnerability is documented on Patchstack's vulnerability database (referenced in the advisory link); consult that resource for detailed remediation guidance and confirmation of patched versions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today