This vulnerability (CWE-502) involves unsafe deserialization in FreightCo software by Theme-Rex, allowing unauthenticated attackers to inject malicious PHP objects. The vulnerability affects FreightCo versions up to and including 1.1.15. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.

Successful exploitation can result in complete system compromise, including unauthorized code execution, data disclosure, and service disruption. Because the vulnerability is exploitable remotely without authentication or user interaction, it poses a severe risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected application and monitor for suspicious activity related to deserialization attempts. Avoid exposing the vulnerable FreightCo versions to untrusted networks.