Remote attackers execute code on Equadio 1.1.4 via unauthenticated PHP injection CVE-2026-62087

ThemeREX’s Equadio WordPress theme contains a critical security flaw that permits unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-62087, affects all versions of the theme up to and including 1.1.4. The National Vulnerability Database rates the issue with a maximum severity score of 9.8.

Root cause

The underlying technical issue is classified as PHP Object Injection, corresponding to CWE-502. This weakness occurs when an application deserializes untrusted data without adequate validation. In this specific instance, the flaw allows an attacker to manipulate the deserialization process. Consequently, an adversary can inject malicious PHP objects directly into the application logic.

Attack path

Attackers do not need valid credentials to exploit this vulnerability. The unauthenticated nature of the flaw means any external actor with network access to the affected site can attempt an attack. By sending crafted requests that trigger the object injection mechanism, an attacker can achieve remote code execution. This grants full control over the compromised WordPress installation.

Affected versions

The vulnerability impacts ThemeREX Equadio themes running version 1.1.4 or earlier. Users operating these specific builds are exposed to the risk. The National Vulnerability Database explicitly lists versions up to 1.1.4 as affected. Later versions may not be vulnerable, but verification is required.

Mitigation

• Identify all installations running Equadio version 1.1.4 or older
• Verify if a patched version is available from ThemeREX
• Monitor server logs for signs of object injection attempts
• Restrict network access to administrative endpoints where possible

Background: WordPress theme vulnerabilities

WordPress theme vulnerabilities are security flaws in the PHP code, stylesheets or scripts that constitute a website’s visual design. Attackers exploit these weaknesses to inject malicious code, steal data or hijack the site. Reducing risk requires auditing code for insecure functions, validating all user inputs and avoiding themes from unverified sources that lack proper sanitisation.

Read the full guide: WordPress Theme Vulnerabilities: Mechanics, Risks and Mitigation

What to do and how to stay safe: Equadio

• Audit your WordPress installations to confirm the Equadio theme version
• Implement web application firewalls to block common injection patterns
• Monitor server logs for unusual deserialization activity or failed requests
• Prepare to update once the vendor provides a verified security patch

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-62087?

The National Vulnerability Database assigns a CVSS score of 9.8 to this vulnerability.

Does the attacker need a user account to exploit this?

No, the vulnerability is unauthenticated, meaning no valid user credentials are required.

Which versions of the Equadio theme are vulnerable?

All versions of ThemeREX Equadio up to and including version 1.1.4 are affected.