Law Office
Monthly
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.