This vulnerability in ThemeMakers Visual Content Composer arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. The affected versions include all releases up to and including 1.5.8. The CVSS 3.1 base score is 9.8, reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no required privileges or user interaction. The vulnerability was published on 2025-08-20, with no vendor patch or advisory details available at this time.

Successful exploitation could allow remote attackers to execute arbitrary code or commands, leading to full system compromise including data theft, modification, or service disruption. The vulnerability affects all users running vulnerable versions of the ThemeMakers Visual Content Composer plugin. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.