This vulnerability in Elated-Themes Leroux (versions before 1.4) is caused by unsafe deserialization of untrusted data, enabling object injection attacks. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts limited to integrity and availability. The vulnerability is publicly disclosed but lacks an official patch or detailed vendor advisory at this time.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to inject objects, potentially leading to integrity and availability issues in the affected application. There is no evidence of confidentiality impact or active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application and monitor for suspicious activity related to deserialization processes. Avoid processing untrusted serialized data where possible.