This vulnerability in BoldThemes Celeste arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. This can result in remote code execution or other severe impacts on the system. The affected versions include all releases up to 1.3.6. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code remotely, leading to full system compromise including loss of confidentiality, integrity, and availability of the affected application and potentially the underlying system. Given the high CVSS score and the nature of object injection via deserialization, the impact is critical to the security posture of affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting features that process serialized data from untrusted sources in BoldThemes Celeste. Monitor vendor channels for updates and apply patches promptly once available.