The vulnerability CVE-2025-68560 in CodexThemes TheGem Theme Elements (for Elementor) arises from improper control over the filename parameter in PHP include/require statements, enabling remote file inclusion. This allows an attacker with low privileges and no user interaction to potentially execute arbitrary code remotely. The affected versions are up to and including 5.10.5.1. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to remote code execution on the affected system, compromising confidentiality, integrity, and availability of the application and potentially the underlying server. This could allow attackers to execute arbitrary code, manipulate data, or disrupt service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme elements if feasible. Monitor official CodexThemes communications for updates and apply patches promptly once available.