This vulnerability (CVE-2026-39580) affects Select-Themes Micdrop and is categorized as CWE-502: Deserialization of Untrusted Data. It allows unauthenticated attackers to perform PHP Object Injection, potentially leading to remote code execution or other severe impacts. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. The affected versions are Micdrop versions up to and including 1.3.1, though exact affected versions were not explicitly stated in the input data. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability due to unauthenticated PHP Object Injection. This can allow attackers to execute arbitrary code or manipulate application behavior remotely without any authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable instances and monitor for suspicious activity related to deserialization attacks. Avoid exposing vulnerable versions to untrusted networks.