CVE-2026-62090

PHP Object Injection vulnerability in the WineShop theme in versions up to and including 3.20. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

An unauthenticated attacker can remotely exploit the vulnerability without logging in, potentially leading to application takeover or arbitrary code execution. Organizations using this theme are at risk of compromise.

Update the WineShop theme to the latest version that does not contain the vulnerability. If updating is not possible, consider disabling or removing the theme until a patch is released.