This vulnerability in Mikado-Themes Zoya (<=1.4) is due to unsafe deserialization of untrusted data, leading to PHP Object Injection. An attacker can exploit this flaw without authentication, which may result in remote code execution or other severe impacts. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits in the wild have been reported.

Successful exploitation can lead to remote code execution, complete compromise of the affected system, data confidentiality breach, data integrity loss, and denial of service. The vulnerability is exploitable remotely without authentication, increasing the risk exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying workarounds such as disabling vulnerable deserialization features if possible or restricting access to the affected application. Monitor vendor channels for updates and patches.