This vulnerability in Foodbakery Sticky Cart arises from insecure deserialization of untrusted data, enabling an attacker to perform object injection. This can lead to remote code execution or other severe impacts on the affected system. The CVSS 3.1 base score of 9.8 reflects the critical nature of this flaw, with an attack vector over the network, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. The affected versions include all versions up to 3.2. No official patch or fix has been documented in the provided data.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code remotely, compromise data confidentiality, integrity, and availability of the affected system. This could lead to full system compromise or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Foodbakery Sticky Cart plugin if feasible, or apply any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates.