This vulnerability (CVE-2025-69108) involves unauthenticated PHP Object Injection in ThemeREX Hot Coffee versions up to and including 1.7. It is classified under CWE-502 (Deserialization of Untrusted Data). The vulnerability allows remote attackers to execute arbitrary code or cause denial of service by sending crafted serialized PHP objects to the application. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation has been documented in the provided data.

Successful exploitation of this vulnerability can result in complete system compromise, including arbitrary code execution, data theft, and service disruption. Since the attack requires no authentication and no user interaction, it poses a high risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and monitor for suspicious activity. Avoid exposing the affected application to untrusted networks. Do not rely on generic mitigations as this vulnerability allows unauthenticated remote code execution.