Dev teams urged to act: WineShop <=3.20 has critical 9.8 CVSS PHP injection with no patch available

Security teams managing e-commerce infrastructure must assess their exposure to CVE-2026-62090, a high-severity flaw in the WineShop platform. The National Vulnerability Database lists this issue as critical, with a CVSS score of 9.8. The vulnerability stems from improper handling of serialized data, specifically allowing unauthenticated PHP object injection. This weakness enables attackers to inject malicious objects without prior authentication, potentially leading to remote code execution on affected servers.

What is the technical nature of this vulnerability?

The flaw is classified under CWE-502, which refers to deserialization of untrusted data. In this specific instance, the WineShop application fails to properly validate incoming serialized PHP objects. According to the NVD record, this allows an attacker to inject arbitrary PHP objects into the application logic. Because the injection is unauthenticated, an attacker does not need valid user credentials or session tokens to exploit the weakness. This lowers the barrier for entry significantly, allowing automated scanning tools to identify and exploit the issue at scale.

Which versions of WineShop are affected?

ThemeREX WineShop versions up to and including 3.20 are affected by CVE-2026-62090. The National Vulnerability Database explicitly states that versions "up to 3.20" contain the vulnerability. Organizations running earlier releases are also at risk, as the flaw persists in the codebase prior to the 3.20 release. Developers using the latest available version at the time of this report, version 3.20, are directly impacted. There is no indication in the source material that versions newer than 3.20 exist or that a patched version has been released to resolve this specific CVE.

What is the severity rating and immediate risk?

The vulnerability carries a CVSS score of 9.8, which is rated as critical. This high score reflects the ease of exploitation and the potential impact on system integrity. Because the attack requires no authentication, the vector is remote and the complexity is low. The impact includes full compromise of the application server, allowing an attacker to execute arbitrary code. For software developers and IT teams, this represents an immediate threat to the confidentiality, integrity, and availability of any server hosting an affected version of the WineShop platform.

What is the current status of a fix?

As of the publication of this report, no patch or fix has been confirmed by ThemeREX or listed in the National Vulnerability Database. The NVD record provides the CVE details and severity but does not reference a vendor advisory or a patched version number. Security teams should monitor official ThemeREX channels and the NVD for updates. Until a verified fix is released, organizations must rely on compensating controls to mitigate the risk of exploitation.

Background: CVSS score

The Common Vulnerability Scoring System assigns a numerical value to software flaws based on how easy they are to exploit and how much damage they cause. It uses a standardized formula so teams can compare risks across different products. The base score reflects the vulnerability itself, while temporal and environmental scores adjust for real-world conditions like patches or network exposure.

Read the full guide: CVSS Score Explained: What the Number Actually Means for Your Code

What to do and how to stay safe: WineShop

• Identify all servers and environments running WineShop version 3.20 or earlier to determine the scope of exposure.
• Implement strict network segmentation to limit direct internet access to the application server, reducing the attack surface.
• Deploy web application firewalls with rules to detect and block suspicious serialized data patterns associated with PHP object injection.
• Monitor server logs for unusual PHP execution patterns or unauthorized file modifications that may indicate an active exploit attempt.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-62090?

CVE-2026-62090 is an unauthenticated PHP object injection vulnerability in ThemeREX WineShop versions up to 3.20, rated 9.8 CVSS.

Is there a patch available for this vulnerability?

No, the source material does not indicate that a patch or fixed version has been released by the vendor.

Which CWE category does this vulnerability fall under?

The vulnerability falls under CWE-502, which covers deserialization of untrusted data.