WineShop EUVD-2026-96493

Exploitation requires a vulnerable installation of the ThemeRex WineShop WordPress theme at version 3.20 or earlier, with a reachable request path that passes attacker-supplied input into a PHP unserialize() operation. Per CVSS PR:N/UI:N, no authentication or user interaction is required against a default install. The practical limiting factor is that PHP Object Injection yields meaningful impact (RCE, arbitrary file write/read, SQLi) only when an exploitable POP gadget chain is present in the theme code, co-installed plugins, or the WordPress/PHP runtime; absent a usable gadget the injection may be of reduced impact. Deployment is further limited to sites specifically running this niche wine-shop theme.

Signals are consistent in direction but limited in breadth. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity, and availability impact - the maximum severity profile short of a scope change, which is typical for PHP Object Injection (CWE-502) that can lead to remote code execution via gadget chains. However, exploitation-likelihood telemetry is absent: no EPSS score, no CISA KEV listing, and no POC indicator were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical caveat for PHP Object Injection is that real-world impact depends on the presence of a usable POP gadget chain in the theme or co-resident plugins/WordPress core; the single Patchstack reference substantiates the vulnerability class and affected version (<= 3.20) but does not confirm a weaponized chain. Net: a genuinely high-severity, easily reachable bug that warrants prompt patching, but not demonstrably under mass exploitation - treat as high-priority remediation rather than confirmed emergency. No signals conflict; the main gap is missing exploitation-probability data.

A remote, unauthenticated attacker sends a crafted request to a vulnerable endpoint of the WineShop WordPress theme (<= 3.20) containing a malicious serialized PHP object. When the application deserializes the attacker-controlled data, a property-oriented programming (POP) gadget chain is triggered, potentially leading to file operations, SQL injection, or remote code execution depending on available gadgets. No public exploit code was identified at time of analysis.