TheGem Demo Import (for WPBakery) lacks proper authorization checks, allowing an attacker to trigger the import routine and delete arbitrary WordPress content. Reports indicate the flaw could remove posts, pages, media, or other site data, thereby compromising data integrity. Unauthorized deletion does not provide code execution, but the loss of legitimate content can have significant operational and reputational consequences.

The vulnerability affects CodexThemes’ TheGem Demo Import (for WPBakery) plugin versions through 5.10.5. Users running these plugin releases on WordPress sites are susceptible if the import functionality is exposed without proper permission checks.

The CVSS score of 6.5 signals moderate severity, while an EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is any user who can access the import feature, even without elevated privileges, suggesting that compromised or unauthenticated accounts could trigger content removal. No additional exploitation requirements are mentioned in the advisory.