The vulnerability is a local file inclusion flaw caused by improper validation of filenames used in PHP include/require statements. An attacker can supply a crafted path that resolves to an arbitrary file on the server, potentially exposing sensitive configuration files or enabling code execution if remote file inclusion is possible. This weakness aligns with CWE-98, reflecting incorrect handling of user input as a filename. The vulnerability allows the attacker to read arbitrary files, which may lead to information disclosure and, if remote files are allowed, to remote code execution.

CodexThemes TheGem Theme Elements (for Elementor) plugin version 5.10.5.1 and earlier. The issue affects all releases up to and including 5.10.5.1.

The CVSS score of 7.5 indicates a high severity risk, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves sending a crafted URL or input that manipulates the filename in the plugin’s include logic; an attacker would need access to a part of the site that allows input to the include path. Successful exploitation could expose local files and, in the case remote file inclusion is enabled, run arbitrary PHP code on the server.