Wine House EUVD-2026-96477

Exploitation requires that the target WordPress site has the Wine House theme (version 3.20 or earlier) installed and active, and that an attacker-reachable input is deserialized via unserialize(). Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed, so any unauthenticated remote request to the affected endpoint can deliver the payload against a default installation of the theme. The principal practical LIMITING factor - not reflected in the 9.8 score - is that full code execution via PHP Object Injection depends on the availability of a usable POP gadget chain within the theme, WordPress core, or co-installed plugins; without such a gadget, impact may be reduced to denial of service or be non-exploitable. The narrow deployment base (a single commercial theme) further constrains the realistic target population.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack with full Confidentiality, Integrity, and Availability impact, yielding a 9.8 'Critical' base score consistent with the CWE-502 (deserialization / PHP Object Injection) weakness class, where a crafted serialized payload reaching an unserialize() call can trigger property-oriented programming (POP) gadget chains leading to RCE, file operations, or SQL injection. This signal is internally consistent - an unauthenticated deserialization bug plausibly justifies PR:N and high impact. However, several key real-world exploitation signals are MISSING from the provided data: there is no EPSS probability, no CISA KEV listing, and no POC/exploit-code indicator supplied, so exploitation likelihood cannot be quantified. A critical caveat for PHP Object Injection specifically: practical weaponization almost always depends on the presence of a usable POP gadget chain in the loaded codebase (the theme plus WordPress core/plugins); absent a known gadget, impact can in practice be limited to denial of service or be non-exploitable, so the H/H/H impact represents worst-case potential rather than confirmed universal RCE. Net assessment: treat as a high-priority patch for any site actually running this theme given the unauthenticated network vector, but recognize the real-world footprint is narrow (a single commercial WordPress theme) and active exploitation is unconfirmed.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Wine House theme (<= 3.20), supplying an attacker-controlled serialized PHP object to an input that is passed to unserialize(). If a suitable POP gadget chain exists in the loaded code, object instantiation triggers unintended method calls that can lead to remote code execution, arbitrary file access, or data manipulation. No public exploit code was identified in the provided data, and successful code execution is contingent on an available gadget chain.