Windsor WordPress Theme: Unauthenticated PHP Object Injection
Summary
The ThemeREX Windsor WordPress theme in versions up to and including 2.10 contains an unauthenticated PHP Object Injection flaw (CWE-502). An attacker can send crafted data to the site without logging in, which can manipulate how the application processes objects on the server. Depending on other code installed on the site, this may lead to file deletion, disclosure of sensitive data or code execution. The CVSS score is 9.8 (critical).
Affected
- Windsor WordPress theme versions <= 2.10 (ThemeREX)
Fixed in
- Unknown. Patchstack lists no official patch, and no vendor advisory or fixed version from ThemeREX has been confirmed.
Workaround
- Patchstack has published a mitigation rule that blocks attacks until an official patch is available.
- If the theme is not in use, deactivate it.
- Restrict access to the site where possible.
Exploitation
- No known exploitation according to CISA SSVC data (exploitation: none, automatable: yes).
- Patchstack expects exploitation and notes that the flaw is suitable for mass-exploit campaigns.
- No public proof of concept found.
Our recommendation
- Check whether the Windsor theme is installed and which version is active on all WordPress sites.
- If the theme is not needed, deactivate and remove it.
- If it is needed, enable the Patchstack mitigation or a comparable web application firewall rule and ask ThemeREX or the purchase channel for a confirmed fixed version.
- Create a backup before any change and monitor logs for unusual requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-66563 patchstack.com
- OpenCVE CVE-2026-66563 app.opencve.io
- ThemeForest Windsor theme listing themeforest.net
- HOL Guard CVE-2026-66563 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:27.
Original description (NVD)
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.