CVE-2026-62120: Law Office PHP Object Injection Vulnerability

CVE-2026-62120 Overview

CVE-2026-62120 is an unauthenticated PHP Object Injection vulnerability affecting the Law Office WordPress theme in versions up to and including 3.20. The flaw is categorized under CWE-502: Deserialization of Untrusted Data and allows remote attackers to inject malicious PHP objects without authentication. Successful exploitation can lead to arbitrary code execution, data tampering, or full site compromise when a suitable property-oriented programming (POP) gadget chain is present in the WordPress environment.

Critical Impact
Unauthenticated attackers can submit crafted serialized payloads over the network to trigger object instantiation inside the Law Office theme, enabling code execution, privilege escalation, or destructive filesystem operations on affected WordPress sites.

Affected Products

Law Office WordPress theme, versions <= 3.20
WordPress installations with the vulnerable theme active
Any site reachable over the network running the affected theme version

Discovery Timeline

2026-10-10 - CVE-2026-62120 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-62120

Vulnerability Analysis

The vulnerability stems from unsafe deserialization of attacker-controlled input in the Law Office theme. The theme passes untrusted data to PHP's unserialize() function without validating origin, structure, or allowed classes. When PHP deserializes the payload, it instantiates arbitrary objects and invokes magic methods such as __wakeup(), __destruct(), and __toString().

Attackers do not need credentials to reach the vulnerable code path. The attack vector is network-based with low complexity, and no user interaction is required. If a POP gadget chain exists within WordPress core, other installed plugins, or themes, the deserialization primitive escalates to arbitrary file operations, SQL manipulation, or remote code execution.

Root Cause

The root cause is improper input handling before deserialization. The theme accepts serialized data from an untrusted source and passes it directly to unserialize(). PHP has no built-in mechanism to restrict class instantiation during deserialization unless developers explicitly use the allowed_classes option, which the vulnerable code omits.

Attack Vector

An attacker crafts a serialized PHP object representing a known gadget chain, encodes it, and submits it to the vulnerable endpoint exposed by the Law Office theme. When the theme processes the request, PHP reconstructs the object graph and triggers the gadget chain during object lifecycle events. The chain can lead to file writes, command execution, or administrative account creation depending on the gadgets available in the target environment.

See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-62120

Indicators of Compromise

HTTP request bodies or query parameters containing serialized PHP markers such as O:, a:, or s: followed by class and length indicators
Unexpected PHP files written under wp-content/uploads/ or theme directories after suspicious POST requests
Creation of new WordPress administrator accounts without an authenticated audit trail
Outbound network connections from the web server process to attacker-controlled infrastructure

Detection Strategies

Inspect web server access logs for POST requests to Law Office theme endpoints containing serialized object patterns
Deploy a Web Application Firewall (WAF) rule set that identifies PHP serialized payloads in request parameters
Correlate PHP error logs with sudden spikes in unserialize() warnings or notices referencing unknown classes

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root, with alerting on changes to theme and plugin directories
Monitor the wp_users and wp_usermeta tables for unexpected privilege changes
Forward web server, PHP-FPM, and WordPress audit logs to a centralized SIEM for correlation and retention

How to Mitigate CVE-2026-62120

Immediate Actions Required

Identify all WordPress sites running the Law Office theme and confirm the installed version against 3.20 or earlier
Deactivate the Law Office theme on affected sites until a patched version is applied
Review web server and WordPress logs for evidence of exploitation attempts dating back to theme installation
Rotate WordPress administrator credentials and application secrets if compromise is suspected

Patch Information

Refer to the Patchstack Vulnerability Report for vendor remediation status and upgrade guidance. Apply any released theme version higher than 3.20 as soon as it is published by the vendor.

Workarounds

Block requests containing serialized PHP object patterns at the WAF or reverse proxy layer
Restrict access to Law Office theme endpoints via IP allow-listing where feasible
Replace the Law Office theme with an alternative WordPress theme if a patched version is not available
Apply the principle of least privilege to the PHP process user to limit the impact of successful exploitation

bash

# Example ModSecurity rule to block serialized PHP objects in request bodies
SecRule REQUEST_BODY "@rx O:\d+:\"[a-zA-Z_\\\\]+\":\d+:" \
  "id:1026062120,phase:2,deny,status:403,\
  msg:'Potential PHP Object Injection payload (CVE-2026-62120)',\
  tag:'CWE-502'"