EUVD-2026-96507
GHSA-5mqj-g4vh-q3mp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site with vulnerable theme
-
DeliverySend crafted serialized PHP object
-
ExploitTrigger unsafe deserialization (CWE-502)
-
ExecutionInstantiate POP gadget chain
-
ImpactExecute code or file operations on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a target WordPress installation running the ThemeRex 'Law Office' theme at version 3.20 or earlier; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and no special non-default configuration is needed beyond having the vulnerable theme active. The practical limiting factor for full code execution is the availability of a usable PHP object-injection gadget chain (POP chain) in the theme, loaded plugins, or WordPress core; without a reachable gadget the deserialization may yield lower impact than the 9.8 implies. Deployment is further limited to sites that have purchased and enabled this specific commercial legal-industry theme. |
| Impact | All provided signals point to a high-priority network-exploitable flaw: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, unauthenticated, low-complexity exploitation with no user interaction and full confidentiality/integrity/availability impact, which is consistent with CWE-502 (deserialization of untrusted data) leading to PHP Object Injection. The vulnerability class is well understood and, when a usable POP gadget chain exists in the theme or its bundled libraries, typically yields remote code execution. However, several key risk signals are MISSING from the input and must not be assumed: no EPSS score is provided, so exploitation probability cannot be quantified; KEV status is absent, so there is no evidence of active exploitation (treat as not KEV-listed); and no POC reference is present, so no public exploit is confirmed. There is also no SSVC decision data. The one contextual caveat is that CWE-502 PHP Object Injection often requires a reachable gadget chain to achieve full impact - the raw 9.8 assumes worst-case code execution, so real-world impact may vary depending on which libraries the theme loads. Net: credible high priority driven by the unauthenticated network vector, but with unknown real-world exploitation volume given absent EPSS/KEV/POC signals. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WordPress site running the ThemeRex Law Office theme (<= 3.20) containing a malicious serialized PHP object, which is deserialized by vulnerable theme code. If a suitable property-oriented programming (gadget) chain is present in the theme, plugins, or WordPress core, the injected object triggers arbitrary code execution or file operations on the server. No public exploit code was identified in the provided data, so this scenario is based on the CVSS vector and the CWE-502 class rather than an observed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
RemediationAI
Available data does not identify a vendor-released patch or a fixed version number for this issue - the Patchstack advisory (https://patchstack.com/database/wordpress/theme/law-office/vulnerability/wordpress-law-office-theme-3-20-php-object-injection-vulnerability?_s_id=cve) and the ThemeRex vendor channel should be checked first for an updated theme release, and any version above 3.20 should be applied immediately once it exists. Because no fix version is confirmed, treat compensating controls as mandatory in the interim: the strongest option is to back up, then deactivate and uninstall the Law Office theme until a patched build is available, accepting the loss of the site's front-end presentation; if the theme must stay live, restrict the affected endpoints to trusted sources, block POST bodies containing PHP serialization signatures such as 'O:' followed by a class name and length prefix at the WAF or reverse proxy, and rate-limit or disable theme AJAX/REST handlers that are not required for the public site. Be aware that serialization-pattern WAF rules are bypassable via encoding, whitespace, and alternate formats, so they reduce rather than eliminate risk, and blocking broadly can break legitimate plugin traffic. Additionally, review installed plugins for usable gadget chains and keep WordPress core and all plugins current to shrink the POP-gadget surface, enable file-integrity monitoring and PHP error/dispatch logging to catch unexpected object instantiation, and consider disable_functions for high-risk PHP sinks such as exec, shell_exec and system, with the caveat that this may break legitimate theme features.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, deserialization of untrusted data, in a PHP/WordPress context. PHP object injection occurs when attacker-supplied input is passed to unserialize(), letting an attacker instantiate arbitrary classes and control their properties; the actual damage is triggered by magic methods such as __wakeup, __destruct, __toString and __call that execute during or after object reconstruction. Achieving code execution or file deletion requires a POP (property-oriented programming) gadget chain - a sequence of classes already loaded via the theme, its bundled plugins, or WordPress core whose magic methods chain into a dangerous sink such as file writes, call_user_func, or SQL. The CPE string cpe:2.3:a:themerex:law_office:*:*:*:*:*:*:*:* identifies the vendor as themerex and the product as law_office with an unbounded version wildcard, matching the described 'through 3.20' range; there is no platform or version granularity beyond the theme itself. The input's 'Microsoft' tag is not corroborated by the CPE, description, or advisory and appears to be misclassified metadata rather than an actual affected platform. The single reference is a Patchstack database entry for the WordPress theme, which is consistent with this being a theme-level WordPress component issue rather than a core or server-side flaw.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated CWE-502 object injection reachable over the network with no user interaction (AV:N/AC:L/PR:N/UI:N); worst-case RCE justifies C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
Executive ViewAI
The ThemeRex 'Law Office' WordPress theme (version 3.20 and earlier) contains a critical unauthenticated PHP object injection vulnerability that could allow remote attackers to fully compromise affected websites. Legal industry organizations running this theme face potential data breaches, site defacement, and operational disruption, which may lead to reputational harm and regulatory scrutiny. With no vendor patch available, immediate mitigation is required to protect sensitive client information and maintain trust.
No vendor-released patch identified at time of analysis. Interim mitigations include: virtual patching via WAF to block serialized object injection attempts; temporarily deactivating the affected theme if feasible; restricting access to wp-admin and enforcing least privilege; monitoring web server and application logs for signs of exploitation; and applying security hardening such as disabling PHP unserialize() where possible or using a WordPress security plugin with object injection protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB