PHP Remote File Inclusion in CodexThemes TheGem Theme Elements
CVE-2025-62045

8.1HIGH

Key Information:

Vendor

WordPress
Status
Thegem Theme Elements (for WPbakery)
Vendor
CVE Published:
6 November 2025

What is CVE-2025-62045?

A vulnerability has been identified in the CodexThemes TheGem Theme Elements for WPBakery that allows for improper control of filename during include or require operations in PHP. This weakness opens doors to remote file inclusion attacks, which could enable attackers to execute arbitrary code on the server by including malicious files. Websites using affected versions (up to 5.10.5.1) are at risk, emphasizing the importance of implementing immediate security measures.

Affected Version(s)

TheGem Theme Elements (for WPBakery) <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/theg...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
JSON
.