A series of serious security flaws have been discovered in TheGem, a widely used premium WordPress theme, impacting over 82,000 active installations globally.
Two separate, yet related, vulnerabilities were found in versions 5.10.3 and earlier of TheGem. Together, these flaws create a critical attack vector that can result in remote code execution and full site compromise.
The issue arises from how files are handled: “The downloaded file is copied to the WordPress uploads directory, which is publicly accessible by default… attackers can exploit the vulnerabilities to upload and execute arbitrary malicious PHP code,” the Wordfence report cautions.
Critical File Upload Flaw (CVE-2025-4317)
The primary vulnerability, which has been assigned a high CVSS score of 8.8, involves a lack of file type validation in the thegem_get_logo_url() function. This oversight enables authenticated attackers with minimal access (such as subscribers) to upload harmful files onto vulnerable servers.
This flaw stems from a failure in the code to properly check the file types being uploaded, allowing potential exploitation.
A critical flaw in TheGem theme allows files to be downloaded unchecked, providing a gateway for attackers to upload harmful PHP scripts.
Theme Settings Access Flaw (CVE-2025-4339)
The second issue, rated with a moderate CVSS score of 4.3, arises from weak authorization controls within the theme’s ajaxApi() function. While a nonce is used to protect the function, it fails to adequately validate user permissions, leaving it open to abuse.
This security flaw enables users with subscriber-level access to alter the theme settings, including changing the logo URL to direct to harmful content.
Cybersecurity experts have detailed a possible exploitation sequence that leverages both vulnerabilities:
- Attackers with subscriber privileges exploit CVE-2025-4339 to change the logo URL to point to a malicious PHP file.
- The website then attempts to load the logo, triggering the thegem_get_logo_url() function to download and store the compromised file without verification.
- Once the file is uploaded, attackers can access it to execute malicious code, potentially taking full control of the site.
Urgent Action Needed
The security flaws in TheGem theme were disclosed to CodexThemes, who swiftly released a patch (version 5.10.3.1) on May 7, 2025.
“We strongly recommend that all users update their sites to the latest version, 5.10.3.1, to mitigate potential risks,” emphasized the Wordfence security team.
Wordfence Premium subscribers have had firewall protections against these vulnerabilities since May 5, while free users will receive this safeguard on June 4, 2025. Site administrators using TheGem should take the following immediate steps:
- Update to TheGem version 5.10.3.1 or later.
- Consider integrating a web application firewall for additional protection.
- Audit user roles and permissions to ensure they align with best security practices.
- Continuously monitor server logs for any unusual activity.
Given that WordPress powers around 43% of all websites worldwide, vulnerabilities in widely-used themes like TheGem pose significant security threats with the potential for widespread consequences.
This situation highlights the critical need for regular software updates, diligent management of user roles, and the implementation of strong security practices such as web application firewalls.
