Live › vulnerability › CVE-2026-61997
Legal Stone, a WordPress plugin, versions up to and including 1.2.11 accept untrusted serialized PHP data without authentication. A remote attacker can use PHP object injection to potentially run code or take control of the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Sites running the Legal Stone WordPress plugin at version 1.2.11 or older are exposed, and the flaw requires no login. Sites that do not have this plugin installed are not affected. unknown whether a default configuration is needed to reach the vulnerable code.
No product ranges from the sources yet.
wp plugin get legal-stone --field=version if WP-CLI is available.1.2.11 as exposed.1.2.11.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-61997")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.