Critical Unauthenticated PHP Object Injection Flaw Found in WineShop <= 3.20
The NVD rates CVE-2026-62090 as critical, affecting WineShop versions up to 3.20 with a CVSS score of 9.8 due to unauthenticated PHP object injection vulnerabilities.
Key points
- The National Vulnerability Database assigned CVE-2026-62090 a CVSS score of 9.8, classifying the severity as critical.
- The flaw allows unauthenticated PHP object injection in ThemeREX WineShop versions 3.20 and earlier.
- The vulnerability is categorized under CWE-502, indicating a failure to validate or sanitize data before processing.
The National Vulnerability Database (NVD) has published a critical security advisory for CVE-2026-62090, identifying a severe flaw in the WineShop e-commerce platform. This vulnerability allows attackers to perform unauthenticated PHP object injection, posing an immediate risk to systems running affected versions of the software.
At a glance
- CVE
- CVE-2026-62090
- Product
- ThemeREX WineShop
- CVSS
- 9.8 Critical
- Weakness
- insecure deserialization
- Exploited
- No known exploitation
The NVD assigned a CVSS base score of 9.8 to CVE-2026-62090, marking it as critical. This high score reflects the ease with which an attacker can exploit the flaw without needing valid credentials. The vulnerability stems from improper handling of PHP objects, enabling remote code execution or other severe impacts on the host system.
Context and Background
The vulnerability is classified under CWE-502, which describes the failure to validate or sanitize data before it is processed by the application. In this specific case, the flaw exists within the PHP processing logic of the WineShop platform. Attackers can inject malicious PHP objects into the application, potentially gaining full control over the server hosting the e-commerce site.
ThemeREX is the developer behind WineShop, a popular e-commerce solution. The advisory specifically notes that versions up to and including 3.20 are affected. This indicates that any installation running these versions or older is vulnerable to exploitation. No newer version has been explicitly cited as patched in the current NVD record.
Who Is Affected
Organizations using ThemeREX WineShop versions 3.20 or earlier are directly at risk. This includes any e-commerce sites built on this platform that have not updated to a version newer than 3.20. The unauthenticated nature of the attack means that public-facing installations are exposed to internet-wide scanning and exploitation attempts.
System administrators and security teams managing WineShop instances must verify their current version immediately. If the installed version is 3.20 or lower, the system is considered vulnerable according to the NVD record. There is no mention of a confirmed fix or patch in the available source material, leaving affected users in a precarious position.
What should you do?
Security professionals should audit their e-commerce infrastructure to identify any instances of WineShop. Determining the exact version number is crucial for assessing risk. Organizations should also monitor network traffic for signs of exploitation attempts, such as unusual PHP object serialization patterns or unexpected outbound connections from web servers.
What to do and how to stay safe: CVE-2026-62090
- Inventory all e-commerce platforms to identify installations of ThemeREX WineShop and check their version numbers against the affected list (up to 3.20).
- Restrict external access to the application using web application firewalls or network segmentation to limit exposure to unauthenticated attackers.
- Monitor server logs and application performance for anomalies that may indicate successful PHP object injection or remote code execution attempts.
- Prepare an incident response plan that includes isolating affected systems, as no confirmed patch or update has been announced by the vendor yet.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-62090?
The National Vulnerability Database rates CVE-2026-62090 with a CVSS score of 9.8, which is classified as critical severity.
Which versions of WineShop are affected by this vulnerability?
ThemeREX WineShop versions up to and including 3.20 are affected by this unauthenticated PHP object injection flaw.
Is there a patch available for CVE-2026-62090?
The source material does not confirm the availability of a patch or update for this vulnerability at this time.
