This vulnerability involves deserialization of untrusted data in the ModelTheme Addons for WPBakery and Elementor plugin, which allows an attacker to perform object injection. The affected versions are any prior to 1.5.6. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, and impacts confidentiality, integrity, and availability. No patch or vendor advisory details are currently available to confirm remediation status.

Successful exploitation can lead to full compromise of the affected WordPress plugin environment, impacting confidentiality, integrity, and availability. This could allow attackers to execute arbitrary code or manipulate application data. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin versions prior to 1.5.6 to mitigate risk.