{"id":"CVE-2026-62120","published":"2026-10-10T20:16:44.300","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/law-office/vulnerability/wordpress-law-office-theme-3-20-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability allows unauthenticated attackers to inject arbitrary PHP objects into the Law Office application, potentially leading to remote code execution and full system compromise. This flaw affects versions up to 3.20.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be triggered through web requests, though successful exploitation may depend on specific application configuration or available classes in the codebase.","blast_radius":"The impact could be severe across all installations running Law Office 3.20 or earlier, potentially allowing attackers to execute arbitrary code, access sensitive data, and fully compromise affected systems without any user interaction.","remediation":"Upgrade to version 3.21 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php-injection","web","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:47:41.188Z"}}