The vulnerability is an unauthenticated PHP Object Injection flaw in the WordPress Wine House theme versions up to 3.20. This flaw allows an attacker to supply malicious serialized payloads that the theme deserializes without adequate validation, potentially executing arbitrary PHP code and enabling full compromise of the affected WordPress site. The flaw is a classic instance of CWE‑502 deserialization of untrusted data.

The flaw affects all installations of the Wine House theme at version 3.20 or earlier, regardless of the underlying WordPress core version. The affected product is the ThemeREX Wine House theme, and any site that has the theme active and running under PHP on a web server can be impacted.

The CVSS score of 9.8 classifies the issue as critical. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is exploitable without authentication, an attacker can trigger the injection simply by sending crafted requests to the site. The attack vector is likely remote via the web interface, and the vulnerability could lead to loss of confidentiality, integrity, and availability of the affected site.