Cyber Resilience

CVE-2025-69356

High

Published: 06 January 2026

Published
06 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-69356 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-69356 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, in the CodexThemes TheGem Theme Elements (for Elementor) plugin for WordPress. It affects all versions of the thegem-elements-elementor plugin from n/a through 5.11.0 and is associated with CWE-98.

The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with high attack complexity by low-privileged authenticated users without requiring user interaction or scope changes. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially leading to arbitrary code execution or full server compromise via local file inclusion.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/thegem-elements-elementor/vulnerability/wordpress-thegem-theme-elements-for-elementor-plugin-5-11-0-local-file-inclusion-vulnerability?_s_id=cve documents this Local File Inclusion vulnerability in the thegem-elements-elementor WordPress plugin version 5.11.0.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows PHP Local File Inclusion.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0.

CWE(s)
CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

LFI vuln in public-facing WordPress plugin directly enables exploitation of the web app (T1190) and web shell deployment/execution via malicious file inclusion (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-13408Shared CWE-98
CVE-2026-39387Shared CWE-98
CVE-2026-3425Shared CWE-98
CVE-2026-27383Shared CWE-98
CVE-2024-51319Shared CWE-98
CVE-2025-30845Shared CWE-98
CVE-2025-26985Shared CWE-98
CVE-2025-52732Shared CWE-98
CVE-2025-69078Shared CWE-98
CVE-2026-24538Shared CWE-98

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates PHP Local File Inclusion by enforcing validation of filenames used in include/require statements to block malicious paths.

SI-2 Flaw Remediation good match
prevent

Addresses the specific flaw in the TheGem Theme Elements plugin by requiring timely identification, reporting, and patching of the vulnerability up to version 5.11.0.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Enables vulnerability scanning to identify the CVE-2025-69356 LFI vulnerability in the WordPress plugin, facilitating proactive remediation.

References