The vulnerability CVE-2025-62045 in TheGem Theme Elements (for WPBakery) arises from improper validation of filenames used in PHP include or require statements, enabling remote file inclusion. This allows attackers to supply a crafted filename that causes the application to load and execute remote code. The issue affects all versions up to and including 5.10.5.1. The CVSS 3.1 base score is 8.1, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no known exploits have been reported in the wild.

Successful exploitation could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. An attacker could execute arbitrary code remotely without authentication, potentially leading to full system compromise. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected TheGem Theme Elements (for WPBakery) plugin or restricting access to the vulnerable functionality to trusted users only. Monitor official CodexThemes communications for updates and apply patches promptly once available.