TheGem (Elementor) is a WordPress theme that suffers from a missing authorization check, allowing attackers to exploit incorrectly configured access control levels. This flaw falls under CWE‑862 and can result in unauthorized access to privileged functions or content that should be restricted to certain user roles. Traditional WordPress administrative pages or content editing features may become accessible to unauthenticated or low‑privilege users.

The affected product is CodexThemes TheGem (Elementor) theme for WordPress. Versions from earliest release through 5.10.5 inclusive are impacted, with no fixed version listed. Users running any of these releases should review their installation and plan for an update.

With a CVSS score of 5.4, the vulnerability is considered moderate, yet the EPSS score of less than 1% suggests a small likelihood of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. Exploitation would likely involve web‑based attacks against the theme’s administrative interfaces, possibly requiring some knowledge of WordPress role configuration. Monitoring for unusual access patterns and applying an update mitigate the risk.