TheGem WordPress Theme Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability exists in TheGem WordPress theme, specifically in versions through 5.10.3, allowing authenticated users with Subscriber-level access and above to upload arbitrary files. This issue arises from inadequate file type validation in the 'thegem_get_logo_url()' function. The vulnerability could potentially lead to remote code execution on the affected site.

Impact

Exploitation of this vulnerability could result in unauthorized file uploads, with the potential for remote code execution on the server.

Remediation

Users are advised to update to TheGem version 5.10.3.1 or a newer patched version.