WineShop PHP Object Injection in v3.20 Lets Attackers Inject Code Without Auth
A critical vulnerability in WineShop versions up to 3.20 allows unauthenticated attackers to inject PHP objects, posing a severe risk to e-commerce sites.
Key points
- The National Vulnerability Database rates CVE-2026-62090 as critical with a CVSS score of 9.8.
- ThemeREX WineShop versions up to and including 3.20 are affected by this unauthenticated flaw.
- The vulnerability is classified under CWE-502, indicating a bad PHP serialization issue.
The National Vulnerability Database has published a record for CVE-2026-62090, identifying a critical security flaw in ThemeREX WineShop. The vulnerability allows for unauthenticated PHP object injection in versions up to 3.20. This issue carries a CVSS base score of 9.8, marking it as a high-severity risk for any deployment using these specific software versions.
The risk
The flaw is categorized under CWE-502, which describes improper deserialization of untrusted data. This weakness enables attackers to inject malicious PHP objects without needing valid credentials. According to the NVD record, the injection can occur on any system running WineShop versions 3.20 or earlier. The high severity score reflects the ease of exploitation and the potential for significant system compromise.
Who is exposed
ThemeREX WineShop installations running version 3.20 or any earlier release are directly exposed to this threat. Small business owners and IT teams managing e-commerce platforms built on this template must verify their current version immediately. Any site that has not updated beyond the 3.20 release remains vulnerable to unauthenticated access attempts leveraging this specific injection vector.
Cost and compliance
The NVD record provides technical details regarding the vulnerability but does not include information on financial costs or specific compliance penalties. Organizations must assess their own regulatory obligations based on the potential for unauthorized access. The lack of confirmed patch details in the source material means that immediate risk mitigation strategies are necessary for compliance postures.
What to watch
Security teams should monitor for unusual PHP object deserialization attempts in web server logs. IT managers must verify the exact version of WineShop installed on their production servers. Without a confirmed fix from the vendor, exposure remains high for all systems running the affected versions.
What to do and how to stay safe: WineShop
- Verify the installed version of WineShop on all production servers to determine if it is 3.20 or earlier.
- Restrict network access to the application using firewalls or web application firewalls to limit exposure.
- Monitor server logs for signs of unauthorized PHP object injection or unusual deserialization activity.
- Contact the vendor to inquire about the status of a security update once one becomes available.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-62090?
The National Vulnerability Database assigns a CVSS score of 9.8 to this vulnerability.
Which versions of WineShop are affected?
ThemeREX WineShop versions up to and including 3.20 are affected by this flaw.
Is there a patch available yet?
No fix has been confirmed in the source material provided.
