This vulnerability is an unauthenticated PHP Object Injection in ThemeREX Abelle software versions <=1.22. It arises from unsafe deserialization of untrusted data, classified under CWE-502. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is currently documented, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems without authentication, potentially leading to full system compromise, data loss, or service disruption. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable installations and monitor for suspicious activity related to PHP object injection attempts.