This vulnerability (CVE-2026-40733) affects Mikado-Themes ShiftUp, specifically versions up to and including 1.3. It is classified as CWE-502, indicating deserialization of untrusted data. The flaw allows unauthenticated attackers to perform PHP object injection, potentially leading to remote code execution. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No vendor advisory or patch information is currently provided.

Successful exploitation can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability is exploitable remotely without authentication, increasing its risk profile. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing application-level protections such as disabling unsafe deserialization or restricting input sources if feasible. Monitor vendor channels for updates.