ThemeREX Equadio Theme 1.1.4 Has Critical Unauthenticated RCE Flaw

ThemeREX’s Equadio WordPress theme contains a critical security vulnerability that allows attackers to execute arbitrary code on affected servers. The National Vulnerability Database assigned the issue CVE-2026-62087 with a maximum severity score of 9.8. This flaw impacts all Equadio versions up to 1.1.4, leaving thousands of websites potentially exposed to immediate compromise.

In plain English

The vulnerability is classified as an unauthenticated PHP object injection. This means an attacker does not need to log in or guess a password to exploit the system. By sending specially crafted data to the website, a threat actor can inject malicious PHP objects. These objects can then execute commands on the server, giving the attacker full control over the site and potentially the underlying infrastructure.

The background

The flaw stems from how the software handles data input, specifically failing to sanitize PHP objects before processing them. The NVD categorizes this weakness under CWE-502, which relates to deserialization of untrusted data. Because the injection is unauthenticated, automated scanning tools or simple scripts can exploit the vulnerability at scale. This makes it particularly dangerous for businesses that rely on the Equadio theme for their public-facing web properties.

What changes now

Organizations using Equadio version 1.1.4 or earlier must treat this as an urgent operational risk. The high severity score indicates that exploitation is technically straightforward and likely to be attempted by malicious actors. Security teams need to verify their current theme versions immediately. Since the source material does not confirm a patch release, users should consider disabling the theme or switching to a secure alternative until a verified fix is available from ThemeREX.

What to do and how to stay safe: ThemeREX

• Audit your WordPress installation to identify if you are running Equadio version 1.1.4 or any earlier version.
• Monitor server logs for unusual activity, specifically looking for unauthorized PHP execution or strange outbound connections.
• Restrict access to your site’s backend using IP whitelisting or additional authentication layers to reduce exposure.
• Once the vendor provides an update, apply it immediately to close the unauthenticated injection vector.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-62087?

It is a critical vulnerability in the Equadio WordPress theme that allows unauthenticated PHP object injection.

Which versions are affected?

All versions of the Equadio theme up to and including 1.1.4 are vulnerable.

Is a patch available?

The source material does not confirm that a patch or fix has been released yet.