CVE-2026-66609

CriticalCVSS 9.3

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.

Risk of unauthorized access to data, modification or deletion, and potential administrator account takeover.

Update the TheGem theme to the latest version that includes the security fix.

Original NVD description (English source)

Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.