Unauthenticated PHP Object Injection in WineShop Theme from Patchstack
CVE-2026-62090

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Wineshop
Vendor
CVE Published:
10 October 2026

What is CVE-2026-62090?

The WineShop theme, versions 3.20 and lower, contains an unauthenticated PHP Object Injection vulnerability that may allow remote attackers to exploit the application. This vulnerability can enable unauthorized access and manipulation of data, posing a significant risk to the security and integrity of the website. It's essential for users of the WineShop theme to upgrade to the latest version to mitigate potential threats.

Affected Version(s)

WineShop <= 3.20

References

https://patchstack.com/database/wordpress/theme/wineshop/...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

johska | Patchstack Bug Bounty Program
.