CVE-2025-60097: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in CodexThemes TheGem WordPress theme, tracked as CVE-2025-60097. The vulnerability affects versions through 5.10.5 and was discovered by Rafie Muhammad from Patchstack. The issue was publicly disclosed on September 26, 2025, and involves broken access control security levels (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization) and has received a CVSS 3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The issue stems from a broken access control problem where authorization, authentication, or nonce token checks are missing in certain functions, potentially allowing unprivileged users to execute higher privileged actions (Patchstack, NVD).

The vulnerability has been assessed with a low severity impact, though it could potentially allow unauthorized users to perform actions beyond their intended privilege level. The CVSS scoring indicates potential impacts on integrity and availability, while confidentiality remains unaffected (Patchstack).

The vulnerability has been fixed in version 5.10.5.1 of TheGem theme. Users are advised to update to version 5.10.5.1 or later to remove the vulnerability. Given the low severity impact, virtual patching has been deemed unnecessary (Patchstack).