This vulnerability (CVE-2026-49107) in Thrive Apprentice allows unauthenticated attackers to perform PHP Object Injection via deserialization of untrusted data in versions before 10.8.10.2. The flaw enables remote attackers to execute arbitrary code or cause denial of service without any authentication or user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects its critical impact and ease of exploitation. No official remediation or patch information is currently available, and no known exploits have been reported in the wild as of the publication date.

Successful exploitation can lead to complete system compromise, including arbitrary code execution, full data confidentiality breach, integrity loss, and denial of service. Because the vulnerability is exploitable remotely without authentication or user interaction, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Thrive Apprentice plugin installations and monitor for suspicious activity related to PHP object deserialization. Avoid exposing the vulnerable plugin to untrusted networks if possible.