The vulnerability CVE-2025-39348 affects ThemeGoods Grand Restaurant plugin versions up to 7.0 and is caused by unsafe deserialization of untrusted data, enabling object injection attacks. This flaw allows remote attackers to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on system security properties. No patch or vendor advisory is currently referenced, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to complete system compromise, including unauthorized code execution, data theft, data manipulation, and service disruption. The critical CVSS score of 9.8 confirms the high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected plugin and monitor for suspicious activity related to deserialization. Avoid processing untrusted data inputs where possible. Do not assume the vulnerability is mitigated without vendor confirmation.