The vulnerability CVE-2026-23542 affects the ThemeGoods Grand Restaurant plugin through deserialization of untrusted data, enabling object injection attacks. This can lead to full compromise of the affected system, impacting confidentiality, integrity, and availability. The affected versions include all releases up to 7.0.10. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on all security properties. No official patch or fix information is available from the vendor or advisory sources at this time.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code or commands on the affected system, leading to complete system compromise. The impact includes full loss of confidentiality, integrity, and availability of the affected application and potentially the underlying host.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable application, monitor for suspicious activity, and consider disabling or removing the plugin if feasible.