The vulnerability CVE-2026-28138 in Stylemix uListing (<= 2.2.0) is caused by deserialization of untrusted data, which enables object injection attacks. This can lead to a complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in full compromise of the affected system's confidentiality, integrity, and availability. Given the high privileges required, the attacker must already have elevated access to exploit this issue. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is referenced, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to high-privilege accounts and avoid processing untrusted serialized data within uListing.