This vulnerability in designthemes Kriya arises from unsafe deserialization of untrusted data, enabling an attacker with at least low privileges to perform object injection attacks remotely without user interaction. The affected versions include all versions up to and including 3.4. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability. This means attackers could execute arbitrary code, manipulate data, or cause denial of service conditions. The vulnerability requires the attacker to have some privileges but no user interaction is needed. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application to trusted users only and monitor for suspicious activity related to deserialization processes. Avoid processing untrusted serialized data where possible.