The vulnerability CVE-2025-49890 affects the ThemeREX Organic Beauty plugin up to version 1.4.6. It is caused by unsafe deserialization of untrusted data, enabling object injection attacks. This can allow an attacker to execute arbitrary code or manipulate application logic remotely without authentication. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to full system compromise, including unauthorized disclosure of sensitive information, modification or deletion of data, and disruption of service. Given the critical CVSS score and the nature of object injection, the impact is severe on affected installations of the Organic Beauty plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or removing the affected plugin to mitigate risk.