CVE-2026-62090: ThemeREX WineShop WordPress Theme - Unauthenticated PHP Object Injection
The ThemeREX WineShop WordPress theme contains an unauthenticated PHP Object Injection issue, classified as CWE-502 (Deserialization of Untrusted Data), in versions up to and including 3.20. The CNA Patchstack rates it critical with a CVSS score of 9.8. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.
Overview
The record describes an unauthenticated PHP Object Injection issue in the ThemeREX WineShop WordPress theme. The weakness is mapped to CWE-502, Deserialization of Untrusted Data. Patchstack is the CNA, and the record's source status is Deferred at the time of collection.
Impact
- Patchstack's record carries a critical severity rating and a CVSS score of 9.8.
- The CVSS vector in the record indicates no privileges and no user interaction are required, with high impact on confidentiality, integrity and availability.
- The SSVC data in the record marks technical impact as total and the issue as automatable.
- Object injection through unsafe deserialization can, in general terms, lead to unintended code paths in the application. The record does not describe the specific consequences in this theme.
Affected products and versions
- Product: ThemeREX WineShop, a WordPress theme.
- Affected range: up to and including 3.20.
- Fixed version: not listed in the record. Whether a fix exists is unknown from the available data.
Exploitation status
The CISA KEV catalog does not list this CVE, so the record does not confirm active exploitation. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00386 with a percentile of 0.31526 as of 2026-10-23, and the SSVC exploitation field is set to none. These values reflect the data at collection time and may change.
Remediation and mitigation
- Identify every site running the WineShop theme and check whether the installed version is 3.20 or earlier.
- Monitor the Patchstack entry and the vendor channels for a fixed release.
- If the theme is not in active use, consider removing it, since no fixed version is listed.
- Limit administrative access, keep WordPress core and other plugins current, and maintain verified backups before any change.
- Developers should avoid passing untrusted input to native deserialization routines.
Detection guidance
- Review web server and application logs for unusual requests to the theme, focusing on payloads that look like serialized data.
- Check for unexpected file changes or new administrative accounts on affected sites.
- Use a web application firewall or security monitoring where available, and tune rules with the vendor or Patchstack guidance.
Limitations of the available information
- The record does not list a fixed version, the specific vulnerable component or endpoint, or technical details of the flaw.
- No vendor advisory from ThemeREX appears in the record.
- Two identical CVSS entries from different providers are present, and one provider field contains a contact address rather than a company name.
- Exploitation status is limited to the KEV listing and the SSVC and EPSS fields in the record.
Sources: Patchstack entry, NVD record.
Frequently asked questions
Which versions of WineShop are affected?
The record places the affected range at up to and including 3.20. It does not list a fixed version, so whether a corrected release exists is unknown from the available data.
Is this vulnerability being actively exploited?
The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00386 as of 2026-10-23.
What should site owners do now?
Check whether the installed WineShop theme is 3.20 or earlier, monitor the Patchstack entry for a fix, consider removing the theme if unused, limit administrative access and keep backups current.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.