CVE-2026-66563 ThemeREX CVE debrief

Who should care

Administrators and security teams responsible for WordPress installations using the Windsor theme should assess exposure and prioritize remediation.

Why it matters

CVE-2026-66563 is a critical vulnerability in the Windsor theme for WordPress, allowing unauthenticated PHP object injection. Defenders should assess exposure, prioritize remediation, and monitor for suspicious activity to prevent potential code execution, data theft, or system compromise.

• Potential code execution on affected systems
• Possible data theft or system compromise
• Requires immediate attention to prevent exploitation

Technical summary

The vulnerability allows unauthenticated PHP object injection in the Windsor theme for WordPress, affecting versions up to 2.10. This could lead to severe consequences if exploited, including code execution, data theft, and system compromise.

Defensive priority

High

Recommended defensive actions

• Review and update the Windsor theme to version 2.11 or later
• Implement additional security measures to prevent PHP object injection attacks
• Monitor for suspicious activity on the affected system

Evidence notes

The vulnerability was reported by Patchstack and is tracked as CVE-2026-66563. The NVD entry is currently .

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.