This vulnerability (CVE-2026-39442) affects PressLayouts PressMart versions <=1.2.26 and is classified as CWE-502: Deserialization of Untrusted Data. It allows unauthenticated attackers to perform PHP object injection, which can result in remote code execution or other severe impacts. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to full compromise of the affected PressMart installation, including unauthorized disclosure of information, modification or destruction of data, and disruption of service. Because the vulnerability is exploitable without authentication, it poses a significant risk to exposed systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected PressMart installations and monitor for suspicious activity related to PHP object injection attempts. Avoid exposing vulnerable versions to untrusted networks.