This vulnerability in ModelTheme Addons for WPBakery and Elementor (versions before 1.5.6) allows an attacker to perform deserialization of untrusted data, resulting in object injection. The CVSS 3.1 base score is 8.8 (high), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. The vulnerability is published and assigned CVE-2025-68531 but lacks vendor advisory or patch information in the provided data.

Successful exploitation can lead to full compromise of the affected WordPress plugin environment, including unauthorized code execution, data manipulation, and service disruption. The high CVSS score indicates severe impact on confidentiality, integrity, and availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin and monitoring for suspicious activity related to deserialization. Avoid using affected versions and upgrade promptly once a patch is released.