This vulnerability (CVE-2026-27414) is classified as CWE-502: Deserialization of Untrusted Data, occurring in Fuelthemes Werkstatt versions up to and including 4.8.3. It allows an attacker with at least low privileges (PR:L) and no user interaction (UI:N) to perform PHP Object Injection via contributor input, potentially leading to full system compromise. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation can result in complete compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary PHP code, manipulate data, or disrupt service. The vulnerability requires network access and low privileges but no user interaction, making it a significant risk if the affected version is in use.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor access and monitor for suspicious activity related to deserialization processes. Avoid using affected versions if possible.