CVE-2025-60096

Vulnerability

Description TheGem (Elementor) theme for WordPress contains a missing authorization vulnerability in versions up to and including 5.10.5. The plugin fails to properly verify access rights on certain administrative functions, leading to broken access control [1].

Exploitation

An authenticated attacker with minimal privileges (e.g., subscriber or contributor) can exploit this flaw by making crafted requests to endpoints that lack proper authorization checks. No additional authentication is required; the attacker simply needs a valid WordPress user account [1].

Impact

Successful exploitation allows the attacker to perform actions intended for higher-privileged users, such as modifying theme settings, creating or deleting users, or altering content. This can compromise the security and integrity of the WordPress site [1].

Mitigation

The vendor has released a fix in version 5.10.6. Users are strongly advised to update to the latest version or apply a firewall rule to block malicious requests. If unable to update, consider restricting file permissions or using a web application firewall [1].