This vulnerability (CVE-2026-40752) in Select-Themes Manufaktur Solutions (<=1.1.1) is an unauthenticated PHP object injection issue, classified as CWE-502, which involves deserialization of untrusted data. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. The vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to remote code execution or denial of service. There is no vendor-provided patch or official remediation information available at this time.

Exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of information, modification of data, and disruption of service. Since no authentication is required, attackers can remotely exploit this flaw over the network. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as disabling vulnerable functionality if feasible or restricting network access to the affected application. Monitor vendor channels for updates.