{"id":"CVE-2026-62087","published":"2026-10-10T20:16:42Z","modified":"2026-10-13T13:28:15Z","title":"Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions","vendor":"ThemeREX","product":"Equadio","tier":"core","eol":null,"description":{"text":"Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an unauthenticated PHP object injection vulnerability in ThemeREX's Equadio product, affecting versions up to and including 1.1.4, where untrusted data is deserialized. An attacker reaching the product over the network needs no privileges and no user interaction, and at low complexity can use the flaw to inject PHP objects, with high potential impact to confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:19:35Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00375,"percentile":0.31503,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/equadio/vulnerability/wordpress-equadio-theme-1-1-4-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-96492","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96492","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62087","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":13.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.3,"detail":"percentile 0.3150"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}