Equadio WordPress Theme Faces Critical Unauthenticated PHP Object Injection Flaw

The National Vulnerability Database has published a record for CVE-2026-62087, identifying a critical security flaw in the Equadio WordPress theme. This vulnerability allows for unauthenticated PHP object injection, enabling attackers to execute arbitrary code on affected systems without needing valid credentials.

The National Vulnerability Database assigns this vulnerability a CVSS score of 9.8, rating it as critical. The flaw is classified under CWE-502, which pertains to the generation of incorrect code or logic. This high severity score reflects the ease with which an attacker can exploit the issue and the significant impact on the confidentiality, integrity, and availability of the compromised server.

Context and Background

PHP object injection is a serious class of vulnerability that occurs when an application deserializes user-controlled data without proper validation. In this specific instance, the Equadio theme fails to adequately sanitize input, allowing malicious serialized objects to be injected into the application logic. According to the NVD record, the weakness stems from improper handling of serialized PHP objects, which can lead to remote code execution.

This type of attack vector is particularly dangerous because it does not require the attacker to log in or bypass authentication mechanisms. The unauthenticated nature of the exploit means that any individual with network access to the vulnerable WordPress site can potentially trigger the injection. This significantly lowers the barrier for entry for malicious actors scanning for vulnerable installations.

Who Is Affected

The vulnerability impacts websites using the Equadio WordPress theme developed by ThemeREX. Specifically, all versions of the theme up to and including version 1.1.4 are affected by CVE-2026-62087. Site administrators who have not updated their theme beyond this version remain exposed to the risk of exploitation.

ThemeREX is a known vendor in the WordPress ecosystem, providing various themes and plugins. The Equadio theme is one of their products, and its widespread use means that a significant number of WordPress sites could be at risk. Administrators must verify their current theme version immediately to determine if their site falls within the affected range.

What should you do?

Site owners and security professionals should audit their WordPress installations for the presence of the Equadio theme. If the theme is installed, they must check the version number against the affected range. Immediate action is required for any site running version 1.1.4 or lower to mitigate the risk of remote code execution.