{"id":"CVE-2026-62090","published":"2026-10-10T20:16:42.617","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/wineshop/vulnerability/wordpress-wineshop-theme-3-20-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A PHP object injection vulnerability in WineShop allows unauthenticated attackers to inject malicious PHP objects, leading to potential remote code execution and full system compromise. This critical flaw affects versions up to 3.20.","exploitability":"Exploitation is relatively straightforward with no authentication required, though it may need a specific request structure and payload targeting the vulnerable object deserialization endpoint.","blast_radius":"The vulnerability could enable attackers to execute arbitrary code on the server, potentially leading to complete system takeover, data exfiltration, and lateral movement within the network.","remediation":"Upgrade to WineShop version 3.21 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","deserialization","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:47:36.022Z"}}