What is the CVSS score of CVE-2026-57804?

CVE-2026-57804 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of TheGem Elementor Elements are affected by CVE-2026-57804?

The CodexThemes TheGem Theme Elements WordPress plugin (versions ≤5.11.1) contains a local file inclusion vulnerability (CVSS 7.5) enabling authenticated users to read sensitive system files and…

How to fix or mitigate CVE-2026-57804?

Within 24 hours, audit all WordPress installations for CodexThemes TheGem Theme Elements versions ≤5.11.1 and immediately restrict plugin access to administrative accounts only, or disable the plugin entirely as interim protection. Within 7 days, implement Web Application Firewall (WAF) rules to block common file inclusion patterns, enable detailed request logging for the plugin, and monitor logs for exploitation attempts. Within 30 days, monitor Patchstack and vendor advisories for patch availability; apply the vendor patch immediately upon release, or migrate affected sites to an alternative Elementor theme provider if the vendor does not release a timely update.

TheGem Elementor Elements CVE-2026-57804

EUVD-2026-43420 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-13 Patchstack

PHP WordPress Information Disclosure LFI Wordpress Plugin Thegem Theme Elements For Elementor Codexthemes

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable but requires a low-privileged authenticated account (PR:L) and non-trivial preconditions (AC:H); local inclusion of PHP yields full C/I/A impact within the site.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:27 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows PHP Local File Inclusion.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.1.

Articles & Coverage 1

News 6 New PHP Vulnerabilities - 6 High Severity, No POC Available Jul 13, 2026

AnalysisAI

Local File Inclusion in the CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin (versions up to and including 5.11.1) lets an authenticated low-privileged attacker coerce the application into including arbitrary local PHP files, exposing sensitive files and potentially executing attacker-influenced code within the site context. Classified as CWE-98 (PHP Remote/Local File Inclusion) and reported by Patchstack, the flaw carries a CVSS 3.1 base score of 7.5 with high impact across confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and no active exploitation on record.

Technical ContextAI

TheGem Theme Elements (for Elementor) is an add-on plugin that extends the Elementor page builder with the TheGem theme's widgets and elements on WordPress/PHP sites. The root cause is CWE-98, Improper Control of Filename for Include/Require Statement, where a value influencing a PHP include()/require() path is not adequately sanitized or restricted to an allowlist. In practice a user-controlled parameter can traverse or select a local file path that the PHP engine then interprets, enabling Local File Inclusion. The affected component per the CPE cpe:2.3:a:codexthemes:thegem_theme_elements_(for_elementor):*:*:*:*:*:*:*:* is the plugin itself; the tags PHP, LFI, and Information Disclosure confirm the disclosure-oriented nature of the flaw, though inclusion of a controllable local PHP file can escalate to code execution within the WordPress runtime.

RemediationAI

No vendor-released patch version was identified in the provided data, so update to the latest available release of TheGem Theme Elements (for Elementor) once CodexThemes publishes a version above 5.11.1, and monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/thegem-elements-elementor/vulnerability/wordpress-thegem-theme-elements-for-elementor-plugin-5-11-1-local-file-inclusion-vulnerability) for the fixed build. As compensating controls while unpatched, apply a WAF or virtual patch (Patchstack offers one) to block file-inclusion and path-traversal patterns targeting the plugin's endpoints; restrict and audit low-privilege accounts since exploitation requires an authenticated session, removing unnecessary contributor/author-level users and disabling open registration; harden PHP by setting open_basedir and disabling allow_url_include/allow_url_fopen to constrain what any include() can reach (trade-off: may break plugins that rely on remote includes or write outside the web root); and enforce least-privilege filesystem permissions on wp-config.php and other sensitive files. WAF rules and PHP hardening reduce but do not eliminate risk and can cause false positives, so test in staging first.