ThemeGoods Grand Tour versions up to 5.6 contain a deserialization of untrusted data vulnerability that permits object injection attacks. This flaw allows an attacker to send crafted serialized data to the application, which when deserialized, can lead to arbitrary code execution or other malicious outcomes. The vulnerability is remotely exploitable without authentication or user interaction, resulting in high impact on confidentiality, integrity, and availability. No vendor patch or advisory details are currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code, manipulate data, or disrupt service on affected installations of Grand Tour. The impact is rated critical with full compromise potential of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and monitor for unusual activity. Avoid processing untrusted serialized data if possible.