{"id":"CVE-2026-112859","kind":"vulnerability","aliases":["CVE-2026-112859"],"related":[],"title":"WordPress Little Birdies theme: unauthenticated PHP object injection to run code","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.","summary":"The Little Birdies WordPress theme by ThemeREX unsafely deserializes untrusted data, which allows PHP object injection. Sources rate it critical (CVSS 9.8) and say no authentication is needed, so an outside attacker may be able to run code or take over the site.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[{"name":"little-birdies","fixed":[],"affected":"<= 1.3.16","ecosystem":"wordpress-theme"}],"ecosystems":["wordpress-theme"],"tags":["little-birdies","package","php","php-object-injection","themerex","unauthenticated","wordpress"],"not_affected_if":["theme-inactive-and-removed","theme-not-installed"],"how_to_check":"Check the installed theme version in WordPress admin under Appearance > Themes, or in style.css of the little-birdies theme directory; versions through 1.3.16 are affected.","fix":"Update the Little Birdies theme to a version newer than 1.3.16; no fixed version is named in the sources, so check the vendor for the patched release.\nIf no patch is available, deactivate the theme and switch to another one.","status":"open","published_at":"2026-10-23T13:17:07+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:10+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:31:10Z","model":"claude-haiku-5-5","output":{"fix":"Update the Little Birdies theme to a version newer than 1.3.16; no fixed version is named in the sources, so check the vendor for the patched release.\nIf no patch is available, deactivate the theme and switch to another one.","reach":"internet","title":"WordPress Little Birdies theme: unauthenticated PHP object injection to run code","impact":"high","summary":"The Little Birdies WordPress theme by ThemeREX unsafely deserializes untrusted data, which allows PHP object injection. Sources rate it critical (CVSS 9.8) and say no authentication is needed, so an outside attacker may be able to run code or take over the site.","category":"package","who_cares":["wordpress","little-birdies","themerex","php"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code on the server or takes over the site","analyst_note":"Confirm the fixed version and whether the vulnerable code path needs a specific theme feature enabled; see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112859.","how_to_check":"Check the installed theme version in WordPress admin under Appearance > Themes, or in style.css of the little-birdies theme directory; versions through 1.3.16 are affected.","needs_analyst":true,"not_affected_if":["theme-not-installed","theme-inactive-and-removed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00055,"input_tokens":2947,"output_tokens":510,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected plugin/theme version range (sources say through 1.3.16), the vulnerable endpoint, and whether a patched release exists; check the NVD page and the ThemeREX vendor advisory.","search":"'-112859':14A,17A '-2026':13A,16A '1.3.16':99C '9.8':54B 'abl':67B 'affect':93C 'allow':45B,89C 'attack':64B 'authent':58B 'birdi':3A,23B,35B,85C,88C,95C 'birdies':20A 'code':11A,70B 'critic':52B 'cve':12A,15A 'cvss':53B 'data':43B,79C 'deseri':41B,76C 'group':83C 'inject':8A,29B,48B 'injection.this':91C 'issu':92C 'littl':2A,22B,34B,84C,87C,94C 'little':19A 'little-birdi':21B,86C 'little-birdies':18A 'may':65B 'n/a':97C 'need':60B 'object':7A,28B,47B,90C 'outsid':63B 'packag':24B 'php':6A,25B,27B,46B 'php-object-inject':26B 'rate':50B 'run':10A,69B 'say':56B 'site':75B 'sourc':49B 'take':72B 'theme':4A,37B 'themerex':30B,39B,82C 'unauthent':5A,31B 'unsaf':40B 'untrust':42B,78C 'vulner':80C 'wordpress':1A,32B,36B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112859","severity":null,"published_at":"2026-10-23T13:17:07+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112859:159","url":null,"severity":null,"published_at":"2026-10-23T22:02:55+00:00","modified_at":"2026-10-23T22:02:55+00:00","first_seen_at":"2026-10-23T22:02:55+00:00","fetched_at":"2026-10-23T22:02:55+00:00","note":"Patchstack advisory (21 Oct 2026) and CVE record: Little Birdies theme <= 1.3.16, unauthenticated PHP object injection, CVSS 9.8, no official patch. Vulnerable endpoint not published. No exploitation or PoC found; did not search social. Patchstack expects mass exploitation."},{"source":"epss","external_id":"CVE-2026-112859","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112859","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":1288,"url":"https://patchstack.com/database/wordpress/theme/little-birdies/vulnerability/wordpress-little-birdies-theme-1-3-16-php-object-injection-vulnerability","title":"Patchstack: Little Birdies theme <= 1.3.16 PHP Object Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1289,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112859","title":"CVE record CVE-2026-112859","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}