This vulnerability (CVE-2026-40757) affects Mikado-Themes Château versions <=1.2.1 and is classified as CWE-502: Deserialization of Untrusted Data. It allows unauthenticated attackers to perform PHP object injection, which can lead to remote code execution, data manipulation, or denial of service. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

Successful exploitation can lead to full compromise of the affected system, including arbitrary code execution, data breach, and service disruption. The vulnerability is exploitable remotely without authentication, but requires high attack complexity. The impact on confidentiality, integrity, and availability is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network exposure of the affected application and monitor for suspicious activity related to PHP object injection. Avoid processing untrusted serialized data if possible.