CVE-2026-62053: CWE-502 Deserialization of Untrusted Data in ThemeREX Wine House

This vulnerability involves unsafe deserialization in the Wine House product by ThemeREX, specifically affecting versions up to 3.20. An attacker can exploit this flaw without authentication by injecting malicious PHP objects, potentially leading to complete confidentiality, integrity, and availability compromise of the affected system. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary code, resulting in full system compromise including data theft, modification, and service disruption. The vulnerability requires no authentication and no user interaction, making it highly severe.

No official patch or remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the affected application and monitor for suspicious activity related to PHP object injection attempts.