This vulnerability allows an attacker to inject an arbitrary PHP object without authentication, enabling the execution of malicious code on the affected WordPress site. The weakness is a PHP Object Injection flaw, classified as CWE-502. With the ability to instantiate objects, an attacker can take full control of the application, compromising confidentiality, integrity, and availability of the site and any data it handles.

The WordPress Law Office theme produced by ThemeREX, in any version 3.20 or older, is affected. Users running these legacy versions on WordPress installations are susceptible to this flaw.

The CVSS score of 9.8 marks this as a critical vulnerability. The EPSS score is not available, but the lack of this metric does not diminish the high likelihood of exploitation by an attacker. The vulnerability is not listed in CISA KEV, yet its impact and severity warrant immediate attention. Attackers can exploit the flaw remotely by sending crafted payloads to the theme’s PHP handling routines, effectively bypassing authentication requirements.