Legal Stone
Monthly
PHP object injection in the ThemeRex Legal Stone WordPress theme through version 1.2.11 allows unauthenticated remote attackers to pass crafted serialized data into the theme's PHP deserialization path, which the vendor-issued CVSS 3.1 vector rates 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A High) and which the priority assessment labels act_now. Because this is a theme rather than a self-contained application, meaningful post-injection impact depends on a usable POP gadget chain being reachable in the theme or in co-installed plugins, and the supplied sources do not identify the injectable endpoint or any specific gadget chain. No CISA KEV entry, no confirmed active exploitation and no public exploit code were identified in the provided intelligence at time of analysis, so the high score reflects worst-case potential on unpatched sites rather than observed attacks.
PHP object injection in the ThemeRex Legal Stone WordPress theme through version 1.2.11 allows unauthenticated remote attackers to pass crafted serialized data into the theme's PHP deserialization path, which the vendor-issued CVSS 3.1 vector rates 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A High) and which the priority assessment labels act_now. Because this is a theme rather than a self-contained application, meaningful post-injection impact depends on a usable POP gadget chain being reachable in the theme or in co-installed plugins, and the supplied sources do not identify the injectable endpoint or any specific gadget chain. No CISA KEV entry, no confirmed active exploitation and no public exploit code were identified in the provided intelligence at time of analysis, so the high score reflects worst-case potential on unpatched sites rather than observed attacks.