{"id":"CVE-2026-62053","published":"2026-10-10T20:16:40.633","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/wine-house/vulnerability/wordpress-wine-house-theme-3-20-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in Wine House versions up to 3.20 that allows unauthenticated attackers to inject arbitrary PHP objects into the application's deserialization process, potentially leading to remote code execution.","exploitability":"Exploitation is relatively straightforward with no authentication required, though it may depend on specific application configuration or available classes in the deserialization chain.","blast_radius":"The vulnerability could affect a wide range of users since it's unauthenticated and impacts core application functionality, potentially allowing attackers to execute arbitrary code on affected systems.","remediation":"Upgrade to version 3.21 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","deserialization","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:47:06.906Z"}}