ThemeREX Law Office WordPress theme: Unauthenticated PHP object injection
Summary
The Law Office WordPress theme by ThemeREX, versions up to and including 3.20, contains an unauthenticated PHP object injection flaw (CWE-502). An attacker can send crafted data over the network without logging in, which can manipulate how the website processes data. The CVSS vector rates confidentiality, integrity and availability impact as high, and code execution depends on gadget chains present in the installation, which are not verified.
Affected
- ThemeREX Law Office WordPress theme, all versions up to and including 3.20
Fixed in
Unknown. Sources conflict. One unverified source mentions version 3.21 or later, but no ThemeREX advisory or release note confirms it. Do not assume 3.21 is the fix until it is verified.
Workaround
- No confirmed workaround from the vendor.
- Deactivate or remove the theme on exposed sites until a fix is confirmed.
- Restrict access to affected sites where feasible.
- Consider WAF rules for deserialization-style requests; virtual patching is not a substitute for a fix.
Exploitation
- Not known to be exploited; not listed in the CISA KEV catalogue according to a GitHub triage alert.
- CNA SSVC: exploitation none, automatable yes, technical impact total.
- EPSS: 0.00304.
- No public proof of concept found.
Our recommendation
- Check all WordPress sites for the Law Office theme, including inactive and staging installations.
- Record the exact version; treat 3.20 or older, or an unknown version, as vulnerable.
- Contact ThemeREX or check the Patchstack entry to confirm the fixed version before updating.
- Until a fix is confirmed, deactivate the theme or restrict access, and monitor logs for unusual requests.
- Re-check NVD and Patchstack in a few days, as the record is still being updated.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory (CVE reference) patchstack.com
- Ionix threat center: CVE-2026-62120 www.ionix.io
- OpenCVE: CVE-2026-62120 app.opencve.io
- HOL Guard: CVE-2026-62120 hol.org
- GitHub triage issue for CVE-2026-62120 github.com
- Vulners: RAPID7:CVE-2026-62120 vulners.com
- ThemeForest: Law Office theme themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:31.
Original description (NVD)
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.