Unauthenticated attackers can exploit CVE-2026-62087 in Equadio versions 1.1.4 and earlier to inject malicious PHP objects.
Key points
- The flaw carries a CVSS score of 9.8, rating it as critical severity.
- It affects ThemeREX Equadio WordPress theme versions up to and including 1.1.4.
- The vulnerability is classified as CWE-502, indicating unauthenticated PHP object injection.
A critical security flaw has been identified in the Equadio WordPress theme developed by ThemeREX. This vulnerability allows unauthenticated attackers to inject malicious PHP objects into affected sites, potentially leading to remote code execution.
What happened
The National Vulnerability Database recorded CVE-2026-62087 as a critical issue with a CVSS score of 9.8. The flaw exists in versions of the Equadio theme up to and including version 1.1.4. Attackers do not need login credentials to exploit this weakness. The underlying issue is categorized as CWE-502, which refers to PHP Object Injection.
This type of vulnerability occurs when an application deserializes untrusted data without proper validation or sanitization. An attacker can craft a request that forces the server to instantiate arbitrary objects. These objects can then execute malicious code on the server. The lack of authentication requirements makes this threat particularly dangerous for public-facing websites. Any site running the affected versions is exposed to this risk.
Why it matters
Unauthenticated remote code execution flaws are among the most severe threats in web security. Attackers can take full control of a compromised server without needing stolen credentials. This allows them to steal data, install malware, or pivot to other systems on the network. WordPress powers a significant portion of the internet, making themes like Equadio high-value targets. A critical CVSS score indicates that exploitation is technically straightforward and likely to succeed. Users who rely on this theme for their online presence face immediate risk. Delaying action could result in data breaches or service disruption.
The fix
- Check your WordPress dashboard for theme updates immediately.
- Verify that your Equadio theme version is higher than 1.1.4.
- If no update is available, contact ThemeREX support for guidance.
- Monitor security advisories for confirmation of a patched release.
Background: WordPress theme vulnerabilities
WordPress theme vulnerabilities arise from poor code quality, outdated libraries, and hidden malicious scripts. You must verify code integrity, update dependencies regularly, and minimize functionality. Never install themes from unverified sources, as they may contain backdoors that grant attackers immediate administrative access to your site.
Read the full guide: WordPress Theme Vulnerabilities: The Hidden Risks You Must Know
What to do and how to stay safe: Equadio
- Audit your WordPress installation to confirm the current Equadio theme version.
- Restrict access to administrative interfaces using IP whitelisting or two-factor authentication.
- Monitor server logs for unusual activity or unexpected object instantiation errors.
- Keep all plugins and core WordPress files updated to reduce overall attack surface.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-62087?
It is a critical PHP object injection vulnerability in the Equadio WordPress theme versions up to 1.1.4.
Is authentication required to exploit this flaw?
No, the vulnerability is unauthenticated, meaning attackers do not need valid login credentials.
Which versions of Equadio are affected?
All versions of the ThemeREX Equadio theme up to and including version 1.1.4 are vulnerable.
