This vulnerability (CVE-2026-39577) involves unauthenticated PHP object injection in Elated-Themes Playroom software versions up to and including 1.4.1. It is categorized under CWE-502, which concerns deserialization of untrusted data. The CVSS 3.1 base score is 8.1, indicating a high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and scope changed. The impact includes limited confidentiality and integrity loss but no availability impact. No patch or official remediation level has been provided as of the publication date.

The vulnerability allows an attacker with network access and high privileges to inject malicious PHP objects without authentication, potentially leading to partial compromise of confidentiality and integrity of the affected system. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restricting access and applying any recommended temporary mitigations from the vendor is advised if available.