External risk intelligence

PHP Object Injection in Yacht Rental Theme Versions Prior to 2.6

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-62054

This vulnerability affects a WordPress theme, which is by design a web-facing application component. WordPress themes are commonly deployed as part of public-facing websites or web applications, making the vulnerable PHP code reachable via the internet in typical deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Yacht Rental technology, allowing unauthenticated attackers to inject malicious code. This could potentially lead to severe compromise of the affected systems, impacting data confidentiality, integrity, and availability. The primary concern is to determine if this technology is in use within our environment.

Unauthenticated code injection in specific software.
Allows attackers to gain full control.
Confirm use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a website using the affected Yacht Rental theme. Since no authentication is required, this allows unauthenticated users to trigger a PHP Object Injection flaw. This could potentially lead to full system compromise.

No authentication needed.
Triggered by a crafted request.
Risk of full system compromise.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated PHP Object Injection in Yacht Rental could allow an attacker to execute arbitrary code on the affected server. This could occur when the application processes unsanitized user input, leading to the deserialization of malicious PHP objects. This could impact the confidentiality, integrity, and availability of the system.

System data and service integrity.
Via unsanitized user input processing.
Arbitrary code execution on server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP Object Injection vulnerability in Yacht Rental affects web applications, indicating that application owners and potentially infrastructure or platform teams managing the web hosting environment are responsible for remediation. The first practical step is to identify all instances of the affected software, determine their exposure and business criticality, and then assign an accountable owner to plan and execute the necessary remediation.

Application and platform owners should address this.
Verify all Yacht Rental installations are in scope.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Yacht Rental theme?

Yacht Rental is a WordPress theme designed to help businesses manage booking and display inventories for boat rentals. Like other themes in the WordPress ecosystem, it controls the visual presentation and core functionality of a website, operating directly on the server to handle user interactions and data requests.

What does PHP Object Injection mean for CVE-2026-62054?

This vulnerability, classified as CWE-502, occurs when the software takes untrusted data and uses it to recreate a PHP object without proper validation. Because the application blindly trusts this input, an attacker can manipulate the object's properties to force the server into performing unintended and potentially malicious actions.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specifically crafted network request containing malicious data to the website. This flaw does not require the attacker to have an account or login to the system. Simply navigating to the site or sending the right input format is sufficient; regular user actions that do not interact with the vulnerable deserialization functions will not trigger the bug.

Is my website at risk from this CVE?

Halo Surface Signal indicates this is a high-priority concern because the Yacht Rental theme is designed to be internet-facing. If your instance is connected to the public web, it is reachable by unauthorized parties. Internal-only sites may have a lower immediate profile, but they remain vulnerable if they are accessible from your broader network.

Do I need to update my Yacht Rental installation?

Your first step is to perform an inventory of all web assets to locate where this theme is running. Once identified, verify your current version number. If you are using version 2.6 or older, coordinate with your technical team to plan an update or apply the vendor's provided patch to mitigate the risk of unauthorized code execution.

References

patchstack.com/database/wordpress/theme/yacht-rental/vulnerability/w…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.