Executive brief
TheGem Theme Elements is a WordPress plugin used to add design components to websites using the Elementor page builder. A security vulnerability in this plugin allows an attacker with basic user permissions to access sensitive internal files on the web server. This could lead to the exposure of database credentials, configuration files, and other private data, potentially resulting in a full site takeover.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the CodexThemes TheGem Theme Elements (for Elementor) plugin (thegem-elements-elementor) due to improper validation of user-supplied input used in PHP include or require statements. An attacker with 'Contributor' or higher privileges can exploit this flaw to include and execute local files on the server. This can be used to read sensitive files like wp-config.php, which contains database credentials. The attack requires network access and authenticated sessions, with a high complexity (AC:H) likely due to specific configuration requirements or input filtering that must be bypassed. As of the advisory date, no official patch has been released.
Affected products
- CodexThemes TheGem Theme Elements (for Elementor) <= 5.11.1
Timeline
- 2026-01-23: disclosed: Vulnerability reported by researcher João Pedro S Alcântara
- 2026-07-13: advisory: Advisory published by Patchstack and NVD