{"id":"CVE-2026-61997","kind":"vulnerability","aliases":["CVE-2026-61997"],"related":[],"title":"Legal Stone WordPress plugin: unauthenticated PHP object injection before 1.2.12","description":"Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.","summary":"Legal Stone, a WordPress plugin, versions up to and including 1.2.11 accept untrusted serialized PHP data without authentication. A remote attacker can use PHP object injection to potentially run code or take control of the site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["legal-stone","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Legal Stone plugin version in the WordPress admin under Plugins, or with `wp plugin get legal-stone --field=version` if WP-CLI is available.\n- Treat any version at or below `1.2.11` as exposed.","fix":"- Legal Stone: unknown; sources give no fixed version beyond the affected range ending at `1.2.11`.","status":"open","published_at":"2026-10-29T16:18:12+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:36+00:00","updated_at":"2026-10-29T16:27:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:27:36Z","model":"claude-haiku-5-5","output":{"fix":"- Legal Stone: unknown; sources give no fixed version beyond the affected range ending at `1.2.11`.","reach":"internet","title":"Legal Stone WordPress plugin: unauthenticated PHP object injection before 1.2.12","impact":"high","summary":"Legal Stone, a WordPress plugin, versions up to and including 1.2.11 accept untrusted serialized PHP data without authentication. A remote attacker can use PHP object injection to potentially run code or take control of the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","legal-stone","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker may run code on the WordPress server","analyst_note":"Confirm the fixed version and any vendor advisory for Legal Stone via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-61997 and the WordPress plugin page.","how_to_check":"- Check the installed Legal Stone plugin version in the WordPress admin under Plugins, or with `wp plugin get legal-stone --field=version` if WP-CLI is available.\n- Treat any version at or below `1.2.11` as exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Legal Stone WordPress plugin at version 1.2.11 or older are exposed, and the flaw requires no login. Sites that do not have this plugin installed are not affected. unknown whether a default configuration is needed to reach the vulnerable code.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000708,"input_tokens":4055,"output_tokens":605,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61997':13A,16A '1.2.11':33B,66C '1.2.12':10A 'accept':34B 'attack':43B 'authent':40B 'code':52B 'control':55B 'cve':11A,14A 'data':38B 'includ':32B 'inject':8A,48B,62C 'legal':1A,18B,23B,64C 'legal-ston':17B 'object':7A,47B,61C 'packag':20B 'php':6A,21B,37B,46B,60C 'plugin':4A,27B 'potenti':50B 'remot':42B 'run':51B 'serial':36B 'site':58B 'stone':2A,19B,24B,65C 'take':54B 'unauthent':5A,59C 'untrust':35B 'use':45B 'version':28B,67C 'without':39B 'wordpress':3A,22B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Legal Stone WordPress plugin at version 1.2.11 or older are exposed, and the flaw requires no login. Sites that do not have this plugin installed are not affected. unknown whether a default configuration is needed to reach the vulnerable code.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61997","severity":null,"published_at":"2026-10-29T16:18:12+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}