This vulnerability (CVE-2026-66609) involves improper neutralization of special elements used in an SQL command (CWE-89) in TheGem (Elementor) plugin by CodexThemes. It affects versions up to 5.12.3 and allows unauthenticated attackers to perform SQL Injection attacks remotely. The CVSS 3.1 score is 9.3, reflecting a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation level has been disclosed as of the published date.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and partial disruption of service (low availability impact). The vulnerability does not impact data integrity. Because it is unauthenticated and remotely exploitable, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected plugin or disabling it if feasible. Monitor official CodexThemes communications for updates on patches or mitigations.