CVE-2025-68560
Remote File Inclusion in TheGem Theme Elements (Elementor
Publication date: 2025-12-23
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| codexthemes | thegem_theme_elements | 5.10.5.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper control of filename for include/require statements in the PHP program of CodexThemes TheGem Theme Elements for Elementor. It is a PHP Remote File Inclusion vulnerability, which means an attacker could exploit the theme to include and execute remote malicious files via manipulated filename inputs.
How can this vulnerability impact me? :
This vulnerability can have a high impact, allowing attackers to execute arbitrary code remotely, potentially leading to full compromise of the affected system, including data theft, data loss, and disruption of service.