EUVD-2026-63295
GHSA-h6f6-6rqr-c7wx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running TheGem theme
-
DeliverySend crafted HTTP request with SQL payload
-
ExploitInjected query executes against WordPress database
-
ExecutionExtract credentials and secrets from tables
-
ImpactEscalate to account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that a publicly reachable WordPress site runs the TheGem (Elementor) theme at version 5.12.3 or earlier and that the vulnerable code path is reachable over HTTP - no authentication, credentials, or user interaction are needed (PR:N/UI:N), consistent with default configurations being exploitable. The specific injectable parameter or endpoint is not disclosed in the provided data, so defenders cannot yet scope which exact request triggers it; this is a knowledge gap rather than a configuration limiter. The primary practical limiter is simply whether the site runs the affected theme version. |
| Impact | The signals align toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, and C:H reflects full read access to sensitive data, driving the 9.3 score together with the vendor's scope-change (S:C) and partial-availability (A:L) choices. Integrity impact is rated none (I:N), consistent with a read-oriented (UNION/boolean/blind SELECT) injection rather than data modification. Tempering the raw score: the CVE is not in CISA KEV and no POC is referenced, so there is no confirmed active exploitation - the danger is currently potential rather than observed. EPSS was not provided in the input, so exploitation probability cannot be quantified here, and SSVC decision inputs (automatable, technical impact) were not supplied; however, unauthenticated web SQLi is historically automatable once exploit code surfaces, so risk could escalate rapidly. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a public TheGem-powered WordPress site, embedding SQL syntax in a parameter the theme passes unsanitized into a database query. The injected query returns backend data - for example password hashes from wp_users or secret keys from wp_options - enabling account takeover or further compromise. No public exploit code is currently referenced, but the low attack complexity means a working exploit could be derived quickly from the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
SQL injection in the TheGem (Elementor) WordPress theme by CodexThemes affects all versions up to and including 5.12.3, letting unauthenticated remote attackers inject crafted SQL into a vulnerable query parameter (CWE-89). Reported by Patchstack and rated CVSS 9.3, the flaw has a network attack vector with no privileges or user interaction, exposing database contents such as credentials and configuration secrets. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a strong patching priority.
RemediationAI
Update TheGem (Elementor) to the first fixed release above 5.12.3 published by CodexThemes; the input does not include an exact fixed version, so confirm the patched version from the Patchstack advisory (https://patchstack.com/database/wordpress/theme/thegem-elementor/vulnerability/wordpress-thegem-elementor-theme-5-12-3-sql-injection-vulnerability) or the CodexThemes changelog before deploying. Until updated, place a WordPress-aware WAF (Patchstack, Wordfence, or equivalent) with an SQLi virtual-patch ruleset in front of the site to block injection payloads, accepting that generic rules may cause false positives on legitimate complex requests. As additional compensating controls, restrict the WordPress database user's privileges to only the tables it needs to limit exfiltration scope, and monitor web and database logs for anomalous query patterns; these reduce but do not eliminate exposure, so upgrading remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TheGem is a commercial multipurpose WordPress theme distributed by CodexThemes (CPE cpe:2.3:a:codexthemes:thegem_(elementor)), here in its Elementor page-builder edition. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaches a database query without proper parameterization or escaping, so attacker-supplied SQL syntax is interpreted by the backing MySQL/MariaDB engine that WordPress uses. Because theme code executes within the site's PHP context with full database access via $wpdb, an injectable code path can query or exfiltrate any table in the WordPress schema, including wp_users and wp_options.
Know when Thegem Elementor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated low-complexity network SQLi gives AV:N/AC:L/PR:N/UI:N with C:H for DB read; I keep S:U and A:N as single-system read, with I:L for possible query side effects.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
Executive ViewAI
TheGem, a widely-deployed WordPress theme by CodexThemes, contains a critical SQL injection vulnerability (CVSS 9.3) allowing unauthenticated attackers to directly extract database contents including credentials and configuration secrets without any authentication or user action. All WordPress installations running TheGem version 5.12.3 or earlier face immediate risk of unauthorized data exposure and potential credential compromise. Leadership should prioritize rapid remediation as this vulnerability bypasses authentication controls entirely and exposes sensitive organizational data.
Deploy Web Application Firewall (WAF) rules to block SQL injection patterns targeting the vulnerable parameter; restrict database user privileges to minimum required permissions; enable comprehensive query logging and real-time alerting on suspicious database activity; immediately rotate all database credentials to limit damage from potential extraction; implement strict input validation at the application layer if theme code modifications are feasible; isolate affected WordPress instances to a quarantine environment until patched or migrated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB