CVE Intelligence
Analysis AI-assisted

CVE-2026-62053: Wine House WordPress Theme - Unauthenticated PHP Object Injection

CVE-2026-62053 is a critical PHP Object Injection vulnerability (CWE-502) in the Wine House WordPress theme by ThemeREX, affecting versions up to and including 3.20. The record reports it as exploitable without authentication, with a CNA-reported CVSS base score of 9.8. No fixed version is listed in the sources consulted, and no confirmed active exploitation appears there.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-62053 describes a PHP Object Injection issue classified as CWE-502 (Deserialization of Untrusted Data) in the Wine House WordPress theme published by ThemeREX. The record states that the flaw can be triggered without authentication in versions up to and including 3.20. The CNA is Patchstack.

Impact

  • The CNA-reported CVSS base score is 9.8, with high confidentiality, integrity and availability impact.
  • The SSVC data in the record marks technical impact as total and automatable as yes.
  • Deserialization flaws can allow an attacker to influence application behaviour, but the sources consulted do not describe a specific impact chain for this theme.

Affected products and versions

  • Product: ThemeREX Wine House, a WordPress theme.
  • Affected range: up to and including 3.20.
  • No fixed version is listed in the record.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record. No confirmed active exploitation appears in the sources consulted. The EPSS probability is 0.00386 (percentile 0.31526) dated 2026-10-23, and the SSVC exploitation value is none.

Remediation and mitigation

  • Identify every site running the Wine House theme and confirm the installed version.
  • Check the Patchstack entry and the vendor for a release newer than 3.20 and apply it as soon as it is confirmed.
  • Until a fix is verified, limit exposure of affected sites, keep WordPress core and other components updated, and follow standard WordPress hardening practices.

Detection guidance

  • Review web server and application logs for unusual requests to theme endpoints that carry serialized data.
  • Monitor for unexpected file changes and new administrative accounts on affected sites.

Limitations of the available information

  • The record contains no fixed version and no vendor advisory beyond the Patchstack entry.
  • The NVD analysis status is shown as Deferred in the record, so NVD enrichment may be incomplete.
  • Vulnerable parameters and technical exploitation details are intentionally not described here.

Frequently asked questions

Which Wine House versions are affected by CVE-2026-62053?

The record lists versions up to and including 3.20 of the ThemeREX Wine House WordPress theme as affected.

Is there a fixed version available?

The record does not list a fixed version. Check the Patchstack entry and the vendor for an update newer than 3.20.

Is this vulnerability known to be actively exploited?

It is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.