This vulnerability in BoldThemes Avantage arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. The affected versions include all releases up to 2.4.9. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical impact with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an unauthenticated attacker to remotely execute arbitrary code or commands on the affected system, potentially leading to full system compromise including data theft, modification, or denial of service. The vulnerability affects all installations of BoldThemes Avantage up to version 2.4.9. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the vulnerable component if possible. Monitor vendor channels for updates and apply patches promptly once available.