This vulnerability involves deserialization of untrusted data in the Aitasi Coming Soon plugin by Rubel Miah, affecting versions up to 2.0.2. The flaw allows an attacker with high privileges to perform object injection, potentially leading to full compromise of the system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation can lead to complete compromise of the affected system, including unauthorized disclosure, modification, or destruction of data. The vulnerability requires the attacker to have high privileges on the system, which limits the attack surface. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin to trusted users only and monitor for suspicious activity related to deserialization processes. Avoid running the plugin in environments where untrusted input can be processed.