Yacht Rental WP Theme Leaves Sites Open to Critical Code Injection With No Patch Available
A severe vulnerability in the Yacht Rental WordPress theme allows unauthenticated attackers to inject malicious code into sites running version 2.6 or earlier.
Key points
- The flaw is rated Critical with a CVSS score of 9.8 by the National Vulnerability Database.
- It affects the Yacht Rental theme from ThemeREX in versions up to and including 2.6.
- No patch or fix has been confirmed by the vendor as of the NVD record publication.
Organisations using the Yacht Rental WordPress theme face immediate risk from a critical security flaw that enables remote code execution. The National Vulnerability Database has assigned CVE-2026-62054 to this issue, highlighting the severity for any site still running older software. This vulnerability requires no authentication, meaning attackers can exploit it without needing valid user credentials or administrative access to the platform.
The issue stems from improper handling of user input within the theme’s PHP code, specifically allowing object injection. According to the NVD record, this weakness is classified under CWE-502, which refers to the deserialization of untrusted data. Attackers can craft malicious payloads that, when processed by the vulnerable theme, allow them to execute arbitrary commands on the server hosting the WordPress installation.
What we know
The vulnerability exists in the Yacht Rental theme developed by ThemeREX. The NVD record specifies that all versions up to 2.6 are affected by this critical flaw. The severity rating of 9.8 indicates that the exploit is highly likely to succeed and can cause significant damage to the affected system’s integrity and availability.
PHP Object Injection is a well-known attack vector where an attacker sends serialized objects to a vulnerable application. When the application deserialises this data, it may instantiate objects that contain malicious code. In this specific case, the lack of authentication means that any individual with internet access can target the site, making public-facing installations particularly vulnerable to automated scanning and exploitation.
The National Vulnerability Database lists the weakness as CWE-502. This classification underscores the fundamental issue of trusting unvalidated data inputs. Without proper validation or sanitisation, the application processes the malicious object, leading to unintended execution of code. This type of flaw often serves as a gateway for further attacks, such as data theft or complete server takeover.
Defender's checklist
- Audit all WordPress installations to identify if the Yacht Rental theme is currently active.
- Check the version number of the theme to confirm if it is 2.6 or lower.
- Review server logs for unusual activity that might indicate attempted object injection.
- Assess the exposure of the site to ensure it is not accessible to untrusted networks.
Background: Attack vectors
Attack vectors meaning refers to the specific method or pathway a cybercriminal uses to infiltrate a computer network or device. These paths include email links, weak passwords, or software flaws. Understanding these routes allows you to block entry points before data is stolen or systems are compromised by malicious code.
Read the full guide: Attack Vectors Meaning: How Threat Actors Breach Defences
What to do and how to stay safe: Yacht Rental
- Identify all WordPress sites using the Yacht Rental theme and verify their current version numbers.
- Isolate affected systems from the internet if immediate remediation is not possible to prevent exploitation.
- Monitor server logs for signs of unauthorised code execution or unexpected object deserialisation attempts.
- Contact ThemeREX directly to inquire about the status of a security update for versions 2.6 and below.
Step-by-step guide: Prevent WordPress Theme Vulnerabilities: Practical Security Measures
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-62054?
It is a critical security vulnerability in the Yacht Rental WordPress theme that allows unauthenticated PHP Object Injection.
Which versions of the theme are affected?
The flaw affects ThemeREX Yacht Rental versions up to and including 2.6, according to the NVD record.
Is there a patch available for this vulnerability?
The source material does not confirm the existence of a patch or fix; users should wait for vendor confirmation.
