It depends on your version of PHP. Using
unserialize to find weaknesses in the application is dependent upon the application having vulnerable classes. If they don't have any classes, then the application is not vulnerable.
However, you may be in luck! I don't actually use the PHP serialization myself because in the past it has been very buggy, with severe security vulnerabilities from PHP itself. I'm not personally familiar with the exact details, and it does depend on the PHP version (which obviously you don't know), but there is a high enough risk that for someone performing security auditing, the answer is legitimately "NEVER pass user data into
unserialize". For the wrong versions of PHP, the result can be a serious disaster.
You have to really know what you are doing to take advantage of said vulnerabilities, but what you end up with is a remote code execution vulnerability in the PHP interpreter itself, which gives the attacker a much bigger prize. Here is a very detailed run-down of the vulnerability in PHP 7. This obviously isn't directly applicable to you, but it shows that the vulnerability is real and it doesn't depend on the user having defined classes:
Also some very basic information: