CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.10.5.1.
Explanation of Vulnerability in Simple Terms
TheGem Theme Elements for WPBakery contains a code injection vulnerability affecting versions up to 5.10.5.1. An attacker without authentication can inject and execute arbitrary code on the site by exploiting improper input handling. This requires specific conditions to trigger but grants full control over site content and functionality. Site administrators should update immediately to a patched version.
What an attacker can do
Run arbitrary code on the site and modify or delete content without authentication.
Potential impact on your site
Complete compromise of site integrity and confidentiality; attacker can steal data, modify pages, or inject malware.
Conditions required to exploit
Network access to the site; no user authentication required, but attack complexity is high.
Key dates
External resources
Related vulnerabilities
