This vulnerability in NooTheme Visionary Core (<= 1.4.9) is caused by unsafe deserialization of untrusted data, enabling an attacker to perform object injection. Exploitation can result in full compromise of the system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation can lead to complete compromise of the affected system, including unauthorized disclosure, modification, or destruction of data and disruption of service. The vulnerability is exploitable remotely with low complexity and minimal privileges, making it a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the affected component and monitoring for suspicious activity related to object injection attempts. Avoid processing untrusted serialized data if possible.