CVE-2026-66563: WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability

Q: Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges to attempt exploitation.

Q: What impact could successful exploitation have?

The reported severity vector indicates network-reachable exploitation with low complexity and no user interaction, with high potential impact on confidentiality, integrity, and availability.

Q: Which versions are affected?

Windsor theme versions 2.10 and earlier are identified as affected.

Published Oct 10, 2026

Updated

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

Affected Software

1 affected component

WordPress Windsor theme<=2.10

Event History

Oct 10, 2026

CVE Published

via MITRE·07:36 PM

Data Sourced

via MITRE·07:36 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges to attempt exploitation.

What impact could successful exploitation have?

The reported severity vector indicates network-reachable exploitation with low complexity and no user interaction, with high potential impact on confidentiality, integrity, and availability.

Which versions are affected?