This vulnerability in Jthemes Prestige (versions before 1.4.1) arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. The CVSS 3.1 base score of 9.8 reflects its critical nature, with network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks vendor patch or advisory details in the provided data.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary code or commands on the affected system, leading to full compromise of confidentiality, integrity, and availability of the application and potentially the underlying system. This could result in data breaches, system takeover, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting features that process serialized data from untrusted sources. Monitor official Jthemes channels for updates and apply patches promptly once released.