Legal Stone EUVD-2026-112963

Exploitable against sites running the ThemeRex Legal Stone WordPress theme at version 1.2.11 or earlier; the supplied CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, so exploitation does not depend on a logged-in session. The principal real-world limiter is that PHP Object Injection (CWE-502) typically requires a reachable POP gadget chain in the theme code or co-installed plugins to achieve meaningful impact - the sources do not identify the specific injectable endpoint or the gadget chain, so successful full compromise may depend on the surrounding plugin/theme environment. Exploitation is further limited to installations of this specific theme at the affected versions.

Signals are largely aligned toward high priority but with important data gaps. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, and PR:N indicates unauthenticated exploitation - consistent with the 'Unauthenticated PHP Object Injection' description and CWE-502. The vuln.today Decision label is act_now, reinforcing urgency, and the report originates from Patchstack, a credible WordPress vulnerability source. However, several decision signals are absent: there is no EPSS exploitation-probability score, no CISA KEV listing, and no confirmed public exploit in the input, so exploitation status is 'no public exploit identified at time of analysis' and active-exploitation claims cannot be made. The real-world risk is therefore driven by CVSS severity and the act_now label rather than by observed exploitation. A key caveat for CWE-502: whether object injection yields full RCE/file operations depends on the presence of a usable POP gadget chain in the theme or co-installed plugins - the C:H/I:H/A:H impact assumes an exploitable gadget exists, which the sources do not confirm. Net: treat as a high-priority patch target given the act_now label and unauthenticated network vector, while noting that exploitation probability (EPSS) and in-the-wild status are unknown.

A remote, unauthenticated attacker sends a crafted request containing a malicious serialized PHP object to an endpoint of a site running the Legal Stone theme (<= 1.2.11), triggering untrusted deserialization (CWE-502). If a suitable POP gadget chain is reachable, this can escalate to arbitrary file operations, data compromise, or code execution. No public exploit is identified in the available data, and the trigger endpoint and required gadget chain are not described in the sources.