This vulnerability is an unauthenticated PHP Object Injection in Select-Themes Hiroshi software versions <=1.5.1. It arises from unsafe deserialization of untrusted data, classified under CWE-502. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation can lead to full compromise of the affected system, including arbitrary code execution, data disclosure, and denial of service. Because the vulnerability is exploitable without authentication and remotely over the network, it poses a significant risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying workarounds such as disabling or restricting deserialization features if possible, or limiting network exposure of the affected application. Monitor vendor channels for updates.