This vulnerability in Themify Popup is classified as CWE-502 (Deserialization of Untrusted Data). It allows an attacker to perform object injection by exploiting unsafe deserialization mechanisms. The affected versions include all versions through 1.4.3. The CVSS v3.1 score is 8.8, indicating a high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been provided by the vendor or in the advisory data.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could inject malicious objects during deserialization, potentially executing arbitrary code or causing denial of service. The vulnerability requires low privileges but no user interaction, making it a significant risk if the affected plugin is in use.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider disabling or removing the Themify Popup plugin if feasible to reduce exposure.