This vulnerability involves improper control of the filename parameter used in PHP include or require statements within TheGem Theme Elements (for Elementor). It allows an attacker with low privileges and no user interaction to perform PHP Local File Inclusion, potentially leading to remote code execution or information disclosure. The affected versions are from an unspecified start through version 5.11.1 inclusive. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in full compromise of the affected web application, including disclosure of sensitive information, code execution, and denial of service. The vulnerability affects confidentiality, integrity, and availability with high impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to affected components and monitor for suspicious activity related to file inclusion attempts.