Critical PHP Object Injection Flaw Found in Wine House WordPress Theme

The National Vulnerability Database has published a new record for CVE-2026-62053, identifying a critical security vulnerability in the Wine House WordPress theme. This flaw allows unauthenticated attackers to perform PHP object injection on any site running affected versions of the software without needing prior login credentials.

The vulnerability carries a CVSS base score of 9.8, which the NVD classifies as critical severity. This high rating reflects the ease of exploitation and the severe impact on system integrity. Attackers can leverage this weakness to execute arbitrary code on the server hosting the WordPress installation, potentially leading to full system compromise.

Context and Background

The underlying weakness is categorized under CWE-502, which refers to the insertion of untrusted deserialized objects. This type of vulnerability typically occurs when an application deserializes data from an untrusted source without proper validation. In this specific case, the Wine House theme fails to adequately sanitize input, allowing malicious serialized objects to be processed by the PHP engine.

PHP object injection is a dangerous class of vulnerability because it can lead to remote code execution. When an attacker injects a crafted serialized object, the application may instantiate classes that perform unintended actions. These actions can include writing files, executing system commands, or accessing sensitive database information, depending on the available class methods within the theme code.

Who Is Affected

ThemeREX is the developer and vendor of the Wine House WordPress theme. According to the NVD record, all versions of the Wine House theme up to and including version 3.20 are affected by this vulnerability. Website administrators using any of these older versions are exposed to the risk of unauthenticated exploitation.

WordPress sites are frequent targets for automated scanning tools that look for known vulnerabilities. Because this flaw requires no authentication, it is particularly attractive to opportunistic attackers. Sites running version 3.20 or earlier should be considered at immediate risk until they are updated to a patched version or mitigated through other security controls.

What should you do?

Security professionals should immediately audit their WordPress installations to identify any use of the Wine House theme. If the theme is present, administrators must verify the installed version against the affected list. Sites confirmed to be running version 3.20 or lower should prioritize remediation efforts to prevent unauthorized access and potential data breaches.