CVE Intelligence
Analysis AI-assisted

CVE-2026-62120: ThemeREX Law Office WordPress theme - unauthenticated PHP Object Injection

An unauthenticated PHP Object Injection weakness (CWE-502) affects the Law Office WordPress theme by ThemeREX up to and including version 3.20. Patchstack reports a CVSS base score of 9.8 (critical), and the record lists no fixed version. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an unauthenticated PHP Object Injection vulnerability in the Law Office WordPress theme published by ThemeREX. The affected range is up to and including 3.20. The weakness is mapped to CWE-502, Deserialization of Untrusted Data, and Patchstack is the CNA that published the entry.

Impact

  • Patchstack assigns a CVSS base score of 9.8 with severity critical, indicating network reachability, no privileges required and no user interaction.
  • The vector in the record describes high impact to confidentiality, integrity and availability.
  • The SSVC technical impact is recorded as total and automatable is recorded as yes.
  • Based on general knowledge of PHP object injection, the practical consequences depend on the classes and code available in the installed environment. This is an inference, not a confirmed result for this theme.

Affected products and versions

  • Product: ThemeREX Law Office, a WordPress theme.
  • Affected range: up to and including 3.20.
  • Fixed version: none is listed in the record. This does not prove that no fix exists.

Exploitation status

The CISA KEV catalogue does not list this CVE. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none. The EPSS probability is 0.00313 with a percentile of 0.23042, as of 2026-10-23.

Remediation and mitigation

  • Check the Patchstack entry and the theme vendor for an updated release newer than 3.20. The record does not provide one.
  • If the theme is in use, plan an update to a verified release once the vendor publishes one, and test it before deployment.
  • If the theme is not required, deactivate and remove it to reduce exposure.
  • As temporary measures, consider restricting access to the site where feasible and reviewing web application firewall rules provided by your hosting or security team.

Detection guidance

  • Review web server and application logs for unusual requests to theme components and for unexpected serialized data in request parameters.
  • Look for unexpected new administrator accounts, modified theme or plugin files and unfamiliar scheduled tasks.
  • Keep backups and integrity baselines so that changes can be compared.

Limitations of the available information

  • The record does not identify the vulnerable parameter, the code path or any fixed version.
  • The sources consulted do not confirm exploitation in the wild.
  • The record shows a source status of Deferred, so details may change as the entry is updated.
  • Whether a specific site is affected depends on the installed version and configuration, which the record does not describe.

Frequently asked questions

Which versions of the Law Office theme are affected?

The record lists the Law Office theme by ThemeREX up to and including 3.20. Versions above that range are not described in the record.

Is there a fixed version?

The record does not list a fixed version. Check the Patchstack entry and the vendor for an update newer than 3.20.

Is this vulnerability known to be exploited?

It is not listed in the CISA KEV catalogue, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.