This vulnerability is a PHP Object Injection issue in Avada versions up to 3.15.3, caused by unsafe deserialization of untrusted data (CWE-502). The CVSS 3.1 score of 8.8 indicates it is exploitable remotely with low complexity and low privileges required, without user interaction. The impact includes high confidentiality, integrity, and availability consequences. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation could lead to remote code execution, full system compromise, denial of service, and data confidentiality and integrity breaches. The vulnerability requires only low privileges and no user interaction, increasing its risk profile. However, no known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and monitor for unusual activity related to deserialization processes. Avoid using untrusted data in deserialization routines where possible.