CVE-2025-60097: 
WordPress vulnerability analysis and mitigation

CVE-2025-60097 is a Missing Authorization (Broken Access Control) vulnerability in the CodexThemes TheGem WordPress theme that allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. It affects TheGem versions from n/a through 5.10.5. The vulnerability was published on September 26, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat CVE, EUVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the TheGem theme fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality or resources. An attacker with a low-privileged account (e.g., a subscriber-level WordPress user) can send network requests to trigger restricted actions without proper authorization checks. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once an attacker has any valid WordPress account on the target site (Red Hat CVE, Patchstack).

Successful exploitation results in limited integrity and availability impacts — an attacker can make unauthorized modifications and potentially disrupt certain theme-related functionality, though confidentiality is not directly impacted (no data disclosure). The scope is unchanged, meaning the impact is confined to the vulnerable WordPress installation. While not critical, this vulnerability could be chained with other weaknesses to escalate privileges or further compromise the site (Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-60097 as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privileged authenticated account on the target WordPress site (Red Hat CVE, EUVD).

1. Reconnaissance: Identify WordPress sites using the TheGem theme at version 5.10.5 or earlier, using tools like WPScan or by inspecting HTTP response headers and page source for theme indicators.
2. Obtain low-privileged access: Register or obtain a low-privileged WordPress account (e.g., subscriber role) on the target site, or use existing credentials.
3. Identify unprotected endpoints: Probe theme-specific AJAX actions or REST API endpoints exposed by TheGem that lack proper capability checks (e.g., wp_ajax_ hooks without current_user_can() validation).
4. Send unauthorized request: Craft and send an authenticated HTTP request (with valid nonce/cookie) to the vulnerable endpoint to trigger restricted functionality — such as modifying theme settings or content — without having the required administrative privileges.
5. Achieve objective: Leverage the unauthorized action to alter site content, disrupt availability, or gather information useful for further attacks (Red Hat CVE, Patchstack).

• Logs: WordPress access logs showing authenticated requests from low-privileged user accounts to admin-only AJAX endpoints (/wp-admin/admin-ajax.php) with TheGem-specific action parameters at unusual times or frequencies.
• Logs: WordPress debug logs or error logs showing unexpected capability checks being bypassed or missing for TheGem theme actions.
• Network: Repeated POST requests to wp-admin/admin-ajax.php from subscriber-level accounts targeting TheGem theme actions.
• File System: Unexpected changes to theme configuration files or WordPress options table entries related to TheGem settings following low-privileged user activity.

Users should update the TheGem WordPress theme to a version beyond 5.10.5 that includes the authorization fix — check the CodexThemes official changelog or WordPress theme repository for the patched release. As an interim workaround, site administrators can restrict user registration or remove untrusted low-privileged accounts to reduce the attack surface. Additionally, a Web Application Firewall (WAF) such as those provided by Patchstack or Wordfence can be used to virtually patch the vulnerability until an official update is applied (Patchstack, Red Hat CVE).

The vulnerability was discovered and reported by Patchstack, which assigned the CVE and published the advisory. No notable public researcher commentary, media coverage, or significant social media discussion has been identified for this vulnerability beyond standard database listings (Patchstack).