The vulnerability CVE-2025-39588 affects bdthemes Ultimate Store Kit Elementor Addons versions up to 2.4.0. It is caused by unsafe deserialization of untrusted data, enabling an attacker to perform object injection. This can result in remote code execution or other severe impacts. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or mitigation guidance is currently provided by the vendor.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized code execution, data disclosure, and service disruption. The critical CVSS score reflects the high risk posed by this flaw if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the affected plugin to mitigate risk. Monitor official bdthemes communications for updates on patches or mitigations.