Equadio theme versions 1.1.4 and earlier contain an unauthenticated PHP Object Injection flaw. User-supplied data can be used to instantiate arbitrary PHP objects, potentially triggering magic methods such as __wakeup, leading to code execution or other destructive behaviors. This weakness is classified under CWE‑502 and carries a CVSS score of 9.8, indicating the ability for attackers to fully compromise affected sites.

WordPress sites that run the ThemeREX Equadio theme with a version ≤ 1.1.4 are vulnerable. Any site using the theme before the latest update is at risk.

With no authentication required, the attack surface is wide; an attacker can send crafted requests to the theme’s PHP entry points to trigger the deserialization. The high CVSS score reflects maximum impact, and although an EPSS score is not available, the severity implies a strong incentive for exploitation. The vulnerability is not currently listed in the CISA KEV catalog, but it remains a high‑risk flaw that should be remediated promptly.