The issues affect TheGem theme versions 5.10.3 and earlier. Experts found two connected vulnerabilities that, when combined, allow attackers to perform remote code execution. This could lead to complete site compromise.
According to a report by Wordfence, attackers can exploit these flaws to upload malicious PHP files to the site’s public uploads folder. They can then access these files to trigger remote code execution.
Details of the Vulnerabilities
Critical File Upload Vulnerability (CVE-2025-4317)
The first vulnerability, with a CVSS score of 8.8, involves arbitrary file uploads. The flaw lies in the thegem_get_logo_url() function, which fails to validate file types. This allows authenticated users with subscriber-level access to upload harmful files.
The vulnerable code downloads files without checking their type. As a result, attackers can upload malicious PHP files to the server.
Theme Options Modification Vulnerability (CVE-2025-4339)
The second vulnerability has a CVSS score of 4.3. It arises from missing authorization checks in the ajaxApi() function. Though this function uses a nonce check, it does not verify user capabilities properly.
This flaw lets subscriber-level users change theme settings, including setting the logo URL to a malicious file.
Attack Chain Explained
Security researchers have outlined how attackers can combine these two vulnerabilities:
- First, attackers use CVE-2025-4339 to change the logo URL setting to a malicious PHP file.
- Next, when the website loads the logo, the thegem_get_logo_url() function downloads the malicious file without checking it.
- Finally, attackers access the uploaded file and execute arbitrary code, potentially taking full control of the website.
Urgent Action Required
The vulnerabilities were reported to CodexThemes, the developers of TheGem. A patched version, 5.10.3.1, was released on May 7, 2025.
“We urge users to update their sites with the latest patched version of TheGem, version 5.10.3.1 at the time of this writing, as soon as possible,” warned the Wordfence security team.
Wordfence Premium users have been protected against these exploits since May 5, 2025. Free users will receive protection starting June 4, 2025.
Recommended Steps for Website Owners
Website administrators using TheGem theme should take the following steps immediately:
- Update TheGem theme to version 5.10.3.1 or newer.
- Implement a web application firewall (WAF) to block malicious traffic.
- Review user roles and permissions to limit access.
- Monitor server logs for any suspicious activity.
Wider Impact and Security Reminder
WordPress powers about 43% of all websites globally. Vulnerabilities in popular themes like TheGem pose serious security risks and can have far-reaching effects.
This incident highlights the need for regular software updates, careful user permission management, and strong security measures such as web application firewalls.
