TheGem Theme Elements plugin for Elementor contains an improper control of filenames used in PHP include/require statements. The vulnerability, described as a PHP Remote File Inclusion, permits an attacker to supply crafted input that causes arbitrary local files to be included and executed on the server. This flaw, identified as CWE‑98, can lead to disclosure of sensitive files or the execution of malicious code. The description explicitly states that local file inclusion is possible, so the exploitation scenario is clear.

CodexThemes TheGem Theme Elements (for Elementor) plugin for WordPress is affected. All releases up to and including version 5.11.1 are vulnerable. The plugin is used in WordPress sites that incorporate the TheGem Theme Elements interface via Elementor.

The CVSS score of 7.5 classifies the issue as high severity, while the EPSS score is below 1% indicating a very low current exploitation probability. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker might craft a request that triggers the vulnerable include, allowing access to any local file or execution of PHP code if a suitable file exists on the server.