This vulnerability is an instance of PHP Object Injection caused by improperly controlled modification of dynamically‑determined object attributes. An attacker can supply crafted input that causes the Drupal Monster Menus module to instantiate arbitrary PHP objects with user‑controlled properties, potentially enabling execution of malicious code or further compromise of the web application.

The Drupal Monster Menus module is affected, with vulnerable releases ranging from 0.0.0 through 9.5.6. No other vendors or products are identified in the advisory.

The Exploit Prediction Scoring System score is currently unavailable, and the vulnerability is not listed in CISA KEV, but the lack of these does not diminish the risk. Because the exploit can be triggered via normal request parameters to the Monster Menus module, it is likely exploitable from any web‑reachable context where the module is enabled. The likely attack vector is via HTTP request parameters sent to the Monster Menus module. The impact is a complete loss of confidentiality, integrity, and availability for the affected application if an attacker succeeds.