CVE-2026-57804
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The TheGem Theme Elements (for Elementor) plugin by CodexThemes contains a PHP Local File Inclusion vulnerability due to improper control of filename for include/require statement. The issue affects versions before 5.12.1.1.
Risk Assessment
An attacker can exploit this vulnerability to read arbitrary files on the server, including configuration files with credentials, potentially leading to full system compromise.
Recommendation
Update TheGem Theme Elements (for Elementor) to version 5.12.1.1 or later, which includes the fix. Additionally, restrict access to configuration files and monitor server logs for suspicious requests.
Other vulnerabilities in TheGem Theme Elements
Original NVD description (English source)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows PHP Local File Inclusion. This issue affects TheGem Theme Elements (for Elementor): from n/a before 5.12.1.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS