This vulnerability, identified as CWE-98, involves improper control of filenames used in PHP include or require statements within CodexThemes TheGem Theme Elements (for Elementor). It allows an attacker to perform PHP Local File Inclusion, potentially enabling execution of arbitrary code or disclosure of sensitive files. The affected versions are all versions up to and including 5.11.1. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary PHP code or access sensitive files on the affected system. This compromises confidentiality, integrity, and availability of the system running the vulnerable theme elements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme elements or applying custom mitigations to restrict file inclusion paths if possible.