TheGem WordPress theme has a missing file type validation in the thegem_get_logo_url() function that allows an authenticated user with Subscriber-level access or higher to upload any file to the server. This flaw can be used to place malicious scripts or binaries on the website, potentially enabling remote code execution and full compromise of the site. The core weakness is a file upload validation failure, mapped to CWE-434.

WordPress sites that use CodexThemes TheGem theme version 5.10.3 or earlier are vulnerable. All installations of these theme releases remain at risk until upgraded or mitigated.

The CVSS score of 8.8 indicates high severity, while the EPSS score of 1% suggests a low-but-not-zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate as a Subscriber or higher, which limits the attack surface but does not eliminate it. Successful exploitation could result in the execution of arbitrary code on the web server and full control of the WordPress installation.