Live › vulnerability › CVE-2026-112859
Go to dashboardThe Little Birdies WordPress theme by ThemeREX unsafely deserializes untrusted data, which allows PHP object injection. Sources rate it critical (CVSS 9.8) and say no authentication is needed, so an outside attacker may be able to run code or take over the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| little-birdies | wordpress-theme | <= 1.3.16 | – |
Check the installed theme version in WordPress admin under Appearance > Themes, or in style.css of the little-birdies theme directory; versions through 1.3.16 are affected.
1.3.16; no fixed version is named in the sources, so check the vendor for the patched releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
This page as .md · .json · in your agent: get_signal("CVE-2026-112859")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.