The WineShop theme for WordPress contains an unauthenticated PHP Object Injection vulnerability in all releases up to and including version 3.20. This flaw allows an attacker to craft a request that forces PHP to deserialize arbitrary object data, effectively enabling the execution of arbitrary code on the server. The interaction does not require any user authentication, so anyone with network access to the WordPress installation can trigger the exploit. The weakness is catalogued as CWE‑502, which describes unserialization of untrusted data leading to code execution.

All WordPress sites running ThemeREX WineShop theme version 3.20 or earlier are affected. The vulnerability is confined to the theme code; any WordPress instance that has this theme active inherits the risk. No specific operating system or PHP version is listed as a requirement beyond the theme’s compatibility.

The CVSS score of 9.8 places this issue in the critical severity range, emphasizing the potential for complete compromise of the underlying web server. Although the EPSS score is not available, the lack of authentication requirement and the high CVSS suggest a high likelihood of exploitation in targeted attacks. The vulnerability is not yet listed in the CISA KEV catalog, but its criticality warrants immediate attention.