This vulnerability is an unauthenticated PHP object injection in Ultimate Maps by Supsystic before version 1.5.0. It arises from unsafe deserialization of untrusted data, classified under CWE-502. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation can lead to full system compromise, including arbitrary code execution and denial of service, without requiring authentication or user interaction. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to deserialization attempts. Avoid using affected versions in exposed environments.