CVE Intelligence
Analysis AI-assisted

CVE-2026-62087: ThemeREX Equadio WordPress theme - PHP Object Injection

An unauthenticated PHP Object Injection flaw (CWE-502) affects the ThemeREX Equadio WordPress theme up to and including 1.1.4, with a CVSS score of 9.8 reported by Patchstack. The record lists no fixed version and no confirmed exploitation, and the CVE is not in CISA KEV. Site owners should confirm whether the theme is installed and follow vendor guidance.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an unauthenticated PHP Object Injection vulnerability in the ThemeREX Equadio theme for WordPress. Patchstack, acting as CNA, published it on 2026-10-10 and classified it as CWE-502 (Deserialization of Untrusted Data). See the Patchstack entry and the NVD record.

Impact

  • The CVSS vector reports network attack vector, low complexity, no privileges required and no user interaction, with high impact on confidentiality, integrity and availability. The score is 9.8 (critical).
  • The SSVC data in the record marks the issue as automatable with total technical impact.
  • Real consequences depend on code paths in the theme and on the rest of the site, which the sources do not describe.

Affected products and versions

  • Product: ThemeREX Equadio, a WordPress theme.
  • Affected range: up to and including 1.1.4.
  • The record lists no fixed version.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed active exploitation appears in the sources consulted. EPSS gives a probability of 0.00386 and a percentile of 0.31525 as of 2026-10-23. SSVC exploitation is recorded as none.

Remediation and mitigation

  • Check whether the Equadio theme is installed on any WordPress site and which version is in use.
  • No fixed version appears in the sources, so confirm with the vendor or Patchstack whether an updated release exists before assuming the issue is resolved.
  • If the theme is not needed, remove it. If it is needed, limit exposure where possible and use compensating controls that you can validate in your own environment.
  • Keep WordPress core, other themes and plugins up to date.

Detection guidance

  • Review web server and application logs for unusual requests, especially those carrying unexpected serialized data in parameters or request bodies.
  • Watch for unexpected file changes or new administrative accounts.
  • Treat any sign of compromise as an incident and follow your internal response process.

Limitations of the available information

  • The record contains no fixed version, no patch reference and no technical details beyond the Patchstack entry.
  • The record's source status is Deferred, so the analysis may be incomplete.
  • Two CVSS entries appear with the same score and vector, one attributed to an email address and one to Patchstack.
  • The vulnerable component and entry point are not described in the sources.

Frequently asked questions

Is this vulnerability exploited in the wild?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The record gives an EPSS probability of 0.00386.

Which versions are affected?

The record lists the Equadio theme up to and including 1.1.4. It does not list a fixed version.

What should site owners do now?

Check whether the theme is installed, ask the vendor or Patchstack whether an updated release exists, remove the theme if it is not needed, and apply compensating controls in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.