{"id":"CVE-2026-62120","published":"2026-10-10T20:16:44Z","modified":"2026-10-13T13:28:15Z","title":"Unauthenticated PHP Object Injection in Law Office <= 3.20 versions","vendor":"ThemeREX","product":"Law Office","tier":"core","eol":null,"description":{"text":"Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.","provenance":"source","from":"NVD"},"summary":{"text":"The Law Office theme by ThemeREX, in versions 3.20 and earlier, contains an unauthenticated PHP object injection flaw (a deserialization of untrusted data weakness). An attacker with network access can exploit it without credentials or user interaction, and no special configuration is required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:20:43Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00304,"percentile":0.23242,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/law-office/vulnerability/wordpress-law-office-theme-3-20-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-96507","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96507","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62120","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":11.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":4.65,"detail":"percentile 0.2324"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}