Key points
- CVE-2026-62090 affects ThemeREX WineShop versions up to and including 3.20.
- The flaw allows unauthenticated PHP object injection with a 9.8 CVSS score.
- No vendor patch or fix has been confirmed for this critical vulnerability yet.
The short version
- ThemeREX WineShop versions up to 3.20 are affected by CVE-2026-62090.
- The vulnerability is an unauthenticated PHP object injection rated 9.8 CVSS.
- No official fix or mitigation guidance has been confirmed by the vendor yet.
The details
The National Vulnerability Database lists CVE-2026-62090 as a critical security flaw in ThemeREX WineShop. The issue affects all versions of the software up to and including version 3.20. According to the NVD record, the vulnerability is classified as an unauthenticated PHP object injection. This weakness allows attackers to inject malicious PHP objects into the application without providing any credentials or authentication.
The Common Vulnerability Scoring System rating for this issue is 9.8, which places it in the critical severity range. The underlying weakness is identified as CWE-502. This classification indicates that the application fails to properly sanitize or validate incoming data before processing it as a serialized PHP object. Attackers can exploit this by sending crafted requests that deserialize malicious objects, potentially leading to remote code execution or other severe impacts.
The context
ThemeREX is the vendor responsible for the WineShop application. The NVD record specifies that versions up to 3.20 are affected by this issue. There is no mention of a patched version in the current source material. The lack of a confirmed fix leaves users of these versions exposed to unauthenticated attacks. The high CVSS score reflects the ease of exploitation and the potential impact on system integrity. Security teams monitoring PHP-based applications should note that object injection flaws often lead to full system compromise if exploited successfully. The absence of authentication requirements makes this vulnerability particularly dangerous for internet-facing deployments.
What should you do?
Users running WineShop version 3.20 or earlier should assume their systems are vulnerable. Since no patch is confirmed, immediate action is required to reduce risk. Administrators should review network logs for signs of exploitation attempts. Isolating affected systems from public networks may help limit exposure until a fix is available.
What to do and how to stay safe: WineShop
- Audit all deployments of ThemeREX WineShop to identify versions 3.20 and below.
- Restrict network access to the application to trusted internal IPs only.
- Monitor server logs for unusual PHP serialization or object deserialization errors.
- Prepare to isolate affected systems from the internet if exploitation is detected.
Step-by-step guide: Automatic Software Updates: 8 FAQs on Security and Risk
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which WineShop versions are affected by CVE-2026-62090?
All versions of ThemeREX WineShop up to and including version 3.20 are affected.
Is there a patch available for this vulnerability?
No confirmed patch or fix has been released according to the current NVD record.
What is the CVSS score for CVE-2026-62090?
The vulnerability has a CVSS score of 9.8, which is rated as critical.
