Critical Unauthenticated PHP Object Injection Found in Yacht Rental WordPress Theme

The National Vulnerability Database has published CVE-2026-62054, identifying a critical security vulnerability in the Yacht Rental WordPress theme. This flaw allows attackers to perform unauthenticated PHP object injection on websites running versions up to 2.6, posing a severe risk to site integrity and user data security.

The vulnerability carries a CVSS score of 9.8, classifying it as Critical according to NVD records. This high severity rating reflects the ease with which an attacker can exploit the flaw without needing valid credentials. The underlying weakness is categorized under CWE-502, indicating a failure to properly sanitize or validate serialized PHP objects before processing them.

Context and Background

PHP object injection vulnerabilities often lead to remote code execution when an attacker can manipulate serialized data. In this specific case, the Yacht Rental theme fails to adequately protect against such manipulation. The National Vulnerability Database records indicate that the flaw exists in the theme's handling of PHP objects, allowing malicious payloads to be executed on the server.

ThemeREX is the vendor responsible for the Yacht Rental theme, a popular choice for marine industry websites. The vulnerability affects all versions of the theme up to and including version 2.6. Users running these versions are exposed to potential compromise unless they take immediate action to mitigate the risk or update to a patched version if available.

Who Is Affected

Website administrators using the Yacht Rental WordPress theme from ThemeREX are directly affected by this vulnerability. Specifically, any installation running version 2.6 or earlier is susceptible to exploitation. The unauthenticated nature of the attack means that public-facing sites are at immediate risk, as attackers do not need to bypass login screens to initiate the exploit.

Security professionals should prioritize scanning their WordPress installations for this specific theme and version range. The critical CVSS score suggests that automated scanning tools may already be detecting attempts to exploit this weakness. Organizations relying on this theme for client websites or internal portals must verify their current version status immediately to assess exposure.

What should you do?

Administrators should audit their WordPress installations to identify any instances of the Yacht Rental theme. If the theme is present, check the version number against the affected range of up to 2.6. Monitor server logs for unusual activity indicative of PHP object injection attempts, such as unexpected serialized data in requests. Keep all WordPress plugins and themes updated to the latest available versions to ensure security patches are applied.