The flaw permits an attacker to supply an arbitrary filename to a PHP include/require statement inside the plugin. Improper control of these file names can lead to remote code execution, data disclosure, or full compromise of the WordPress site. The weakness is identified as CWE‑98, which relates to failures to properly validate or sanitize file paths used in include statements.

TheGem Theme Elements (for WPBakery) plugin supplied by CodexThemes for WordPress is affected. All versions up to and including 5.10.5.1 contain the vulnerability, while any release beyond 5.10.5.1 is presumed to have the fix. Sites running any vulnerable version therefore expose themselves to the RFI risk.

The CVSS score of 8.1 labels the issue as high severity. The EPSS score is reported as less than 1%, indicating a low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an external attacker can trigger the flaw by manipulating HTTP requests that supply unsanitized filename parameters to the plugin’s include routine, enabling remote code execution or sensitive data exposure from an external user context.