CVE-2026-62090

Received Received - Intake

Unauthenticated PHP Object Injection in WineShop

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-62090

EUVD

EUVD-2026-96493

Affected Vendors & Products

Vendor	Product	Version / Range
ThemeREX	WineShop	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This is an unauthenticated PHP Object Injection vulnerability affecting WineShop theme versions 3.20 or lower. Attackers can exploit it to manipulate site data and execute harmful actions on the server without needing authentication.

Impact Analysis

It allows attackers to take control of your website, modify data, or perform malicious actions remotely without any user interaction. The high CVSS score of 9.8 indicates severe risk of exploitation in mass campaigns.

Mitigation Strategies

Apply Patchstack's mitigation rule to block attacks until an official patch is released. Update the WineShop theme to the latest version if available. Seek assistance from a hosting provider or developer for further protection.

Hi! I’m here to help you understand CVE-2026-62090. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70