CVE-2023-37390

The Themesflat Addons For Elementor plugin through version 2.0.0 contains a PHP Object Injection vulnerability in the tf_product_filter AJAX action that accepts the 'settings' parameter without proper validation. An unauthenticated attacker can exploit this by sending a malicious serialized object to trigger unsafe deserialization. If gadget chains exist in other installed plugins or themes, this vulnerability could be leveraged to execute arbitrary code, access confidential information, or remove files from the server.

Based on public CVE data (MITRE/NVD).