{"id":"CVE-2026-66563","published":"2026-10-10T20:16:45.737","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/windsor/vulnerability/wordpress-windsor-theme-2-10-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in Windsor versions up to 2.10, allowing unauthenticated attackers to inject arbitrary PHP objects and execute code remotely. This flaw enables full system compromise without requiring authentication.","exploitability":"Exploitation is relatively straightforward with no authentication required, though it may need a specific payload format that can be crafted from the published vulnerability details.","blast_radius":"The impact could be severe across all Windsor installations running versions 2.10 or earlier, potentially leading to complete system compromise and data breaches.","remediation":"Upgrade to Windsor 2.11 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php-injection","web","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:48:10.766Z"}}