This vulnerability (CVE-2026-39446) involves unauthenticated PHP Object Injection in PressLayouts Kapee software versions before 1.7.0. It is classified under CWE-502 (Deserialization of Untrusted Data). The vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to complete system compromise. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation of this vulnerability can result in full compromise of the affected system's confidentiality, integrity, and availability. Since the attack requires no authentication and can be performed remotely, it poses a significant risk to vulnerable installations of Kapee prior to version 1.7.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable instances and monitor for suspicious activity related to PHP object injection attempts.