This vulnerability (CVE-2026-40751) affects Mikado-Themes Ashtanga, allowing unauthenticated attackers to perform PHP object injection via unsafe deserialization of untrusted data in versions up to and including 1.2. The vulnerability is categorized under CWE-502. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability, potentially allowing remote code execution or other severe impacts due to PHP object injection. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable application and monitor for suspicious activity related to deserialization. Avoid processing untrusted serialized data if possible.