ThemeREX Equadio WordPress theme: PHP Object Injection without authentication

Summary

The Equadio WordPress theme up to and including version 1.1.4 contains an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker on the internet can send crafted input to a vulnerable site, which may lead to code execution, data theft or site disruption, depending on the PHP classes available on the server. The CVSS score of 9.8 was assigned by the CNA Patchstack; NVD has not yet analysed the entry, and no known exploitation or public proof of concept has been confirmed.

Affected

• Equadio WordPress theme (ThemeREX) version 1.1.4 and earlier
• Child themes and copies of the theme on staging sites may also be affected

Fixed in

• Version 1.1.5 is reported as the fixed version by Patchstack and the ThemeForest listing; not yet confirmed by the vendor changelog. Verify before rollout.
• The HOL Guard feed lists no fixed version.

Workaround

• No vendor workaround known.
• If the theme is unused, deactivate and remove it.
• Restrict access to the site and admin paths where possible.
• Use a WAF or virtual patch (for example Patchstack) until the update is applied.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Not listed in CISA KEV; no known exploitation confirmed.
• EPSS 0.00375 (Vulners).
• Public proof of concept: unknown, not confirmed absent.

Our recommendation

• Inventory all WordPress sites using the Equadio theme, including child themes and staging sites.
• Update to version 1.1.5 or later after verifying the fix, or remove the theme if unused.
• Apply a WAF or virtual patch if the update cannot be applied immediately.
• Check affected sites for signs of compromise, such as unknown files, admin users or unexpected PHP activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE record CVE-2026-62087 app.opencve.io
• HOL Guard CVE entry hol.org
• Vulners RAPID7 entry (EPSS) vulners.com
• ThemeForest Equadio listing themeforest.net
• ThemeREX Equadio product page themerex.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:35.