WineShop PHP Object Injection in v3.20 Enables Unauthenticated Code Execution with 9.8 CVSS Score

ThemeREX WineShop contains a critical security vulnerability that allows unauthenticated remote code execution. The issue, tracked as CVE-2026-62090, stems from improper handling of user-supplied data within the application. The National Vulnerability Database rates the flaw as 9.8 CVSS, indicating a severe risk to any system running the affected software versions.

Root cause

The underlying technical issue is classified as CWE-502, which denotes a deserialization of untrusted data. Specifically, the vulnerability involves PHP object injection. This occurs when an application deserializes data without properly verifying its integrity or origin. An attacker can craft a malicious serialized object and inject it into the application. When the application processes this data, it restores the object to memory, allowing the attacker to control the execution flow.

Attack path

Exploitation of CVE-2026-62090 does not require any form of authentication. An attacker can send a specially crafted request to a vulnerable WineShop instance from any location on the internet. The request contains a serialized PHP object that triggers the injection flaw. Upon processing, the application deserializes the object, leading to arbitrary code execution on the server. This grants the attacker full control over the compromised system.

Affected versions

The vulnerability impacts specific versions of the WineShop e-commerce theme. According to the NVD record, the affected range includes:

• ThemeREX WineShop version 3.20
• ThemeREX WineShop versions older than 3.20

Any installation running these versions is susceptible to the unauthenticated attack vector. Users must verify their current version number to determine if their system is within the affected range.

Mitigation

No official patch or fix has been confirmed by the vendor in the provided source material. System administrators should take immediate defensive actions to reduce the risk of exploitation. Isolating affected systems from public networks can limit exposure. Monitoring server logs for unusual deserialization attempts may help detect active attacks.

What to do and how to stay safe: WineShop

• Verify the current version of WineShop installed on all production servers.
• Restrict network access to the application using firewalls to limit exposure.
• Monitor server logs for signs of unauthorized code execution or deserialization errors.
• Contact the vendor, ThemeREX, to inquire about an official security update.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-62090?

The National Vulnerability Database rates CVE-2026-62090 as 9.8 CVSS, which is classified as Critical.

Which software is affected by this vulnerability?

ThemeREX WineShop versions up to and including 3.20 are affected by this unauthenticated PHP object injection flaw.

Does an attacker need a login to exploit this bug?

No, the vulnerability is unauthenticated, meaning attackers can exploit it without needing valid user credentials or access tokens.