This vulnerability involves improper control of the filename parameter used in PHP include or require statements within TheGem Theme Elements (for Elementor). This flaw allows PHP Local File Inclusion, potentially enabling an attacker to include unintended files on the server. The affected versions are up to 5.11.0. The CVSS score is 7.5, indicating a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction.

An attacker with low privileges can exploit this vulnerability remotely to include local files on the server, which may lead to disclosure of sensitive information, code execution, or denial of service. The impact is rated high for confidentiality, integrity, and availability based on the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is currently available. Until a fix is released, avoid using affected versions or restrict access to vulnerable components as a temporary mitigation.