This vulnerability in ThemeMove Core arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. The affected versions include all releases up to and including 1.4.2. Exploitation can result in full compromise of the system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are provided, and it is not a cloud service.

Successful exploitation allows an attacker to inject malicious objects via deserialization, potentially leading to full system compromise including data theft, modification, or service disruption. The vulnerability affects confidentiality, integrity, and availability at a high level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected component and monitor for unusual activity related to deserialization processes. Avoid processing untrusted serialized data where possible.