CVE Intelligence
Analysis AI-assisted

CVE-2026-62054: WordPress Yacht Rental theme up to 2.6 - PHP Object Injection

CVE-2026-62054 is a PHP Object Injection weakness (CWE-502) in the ThemeREX Yacht Rental WordPress theme, affecting versions up to and including 2.6. The record states that it can be triggered without authentication and reports a CVSS 3.1 base score of 9.8. The record lists no fixed version, so administrators should verify the vendor or Patchstack entry and treat affected sites as high priority.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an unauthenticated PHP Object Injection issue in the ThemeREX Yacht Rental WordPress theme, affecting versions up to and including 2.6. The weakness is mapped to CWE-502, Deserialization of Untrusted Data. The entry was published by Patchstack as CNA.

Impact

  • The record reports a CVSS 3.1 base score of 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The SSVC fields in the record indicate the issue is automatable and has total technical impact.
  • Object injection flaws of this class can allow an attacker to influence application logic on the affected site. The exact consequences depend on the code paths and the installed environment, which the record does not describe.

Affected products and versions

  • Product: ThemeREX Yacht Rental (WordPress theme).
  • Versions: up to and including 2.6.
  • Fixed versions: none are listed in the record. This means the fix status is unknown, not that no fix exists.

Exploitation status

  • The record shows the vulnerability is not listed in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.00386 with a percentile of 0.31528, dated 2026-10-23. The SSVC exploitation field is set to none.

Remediation and mitigation

  • Identify every site running the Yacht Rental theme at version 2.6 or earlier.
  • Check the Patchstack entry and the vendor channels for a fixed release, and update to it as soon as it is available.
  • If no fixed release is confirmed, consider temporarily deactivating the theme or moving the site to a maintained alternative.
  • Limit public exposure of administrative and theme-related functions while the risk is assessed.
  • Keep WordPress core, plugins and other themes updated to reduce overall attack surface.

Detection guidance

  • Review web server and application logs for unusual requests to theme components, especially those that handle serialized or encoded input.
  • Monitor for unexpected changes to files, options or database content in the WordPress installation.
  • Maintain an inventory of theme versions across all sites so exposure can be confirmed quickly.

Limitations of the available information

  • The record does not identify the specific vulnerable component, parameter or code path.
  • No fixed version is listed, so the remediation target is unknown.
  • Whether the issue is exploitable under default configurations is not stated.
  • The CVSS source field in the record contains a contact address rather than an organization name, which limits attribution clarity.

Sources consulted: Patchstack vulnerability entry, NVD, CVE Record.

Frequently asked questions

Which versions of the Yacht Rental theme are affected?

The record lists the ThemeREX Yacht Rental theme in versions up to and including 2.6.

Does this vulnerability require authentication?

No. The record describes it as unauthenticated and reports a privileges-required value of none in the CVSS vector.

Is there a fixed version available?

The record does not list any fixed version. The fix status is unknown, so check the Patchstack entry and vendor channels for an update.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.