---
id: "CVE-2026-112859"
kind: "vulnerability"
aliases: ["CVE-2026-112859"]
title: "WordPress Little Birdies theme: unauthenticated PHP object injection to run code"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "package"
products: [{"name": "little-birdies", "fixed": [], "affected": "<= 1.3.16", "ecosystem": "wordpress-theme"}]
ecosystems: ["wordpress-theme"]
tags: ["little-birdies", "package", "php", "php-object-injection", "themerex", "unauthenticated", "wordpress"]
not_affected_if: ["theme-inactive-and-removed", "theme-not-installed"]
published_at: "2026-10-23T13:17:07+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112859", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:02:55+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112859", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# WordPress Little Birdies theme: unauthenticated PHP object injection to run code

The Little Birdies WordPress theme by ThemeREX unsafely deserializes untrusted data, which allows PHP object injection. Sources rate it critical (CVSS 9.8) and say no authentication is needed, so an outside attacker may be able to run code or take over the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:little-birdies affected <= 1.3.16 fixed ?

## How to check

Check the installed theme version in WordPress admin under Appearance > Themes, or in style.css of the little-birdies theme directory; versions through 1.3.16 are affected.

## Fix

Update the Little Birdies theme to a version newer than 1.3.16; no fixed version is named in the sources, so check the vendor for the patched release.
If no patch is available, deactivate the theme and switch to another one.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112859
- 2026-10-23T22:02:55+00:00 analyst — Patchstack advisory (21 Oct 2026) and CVE record: Little Birdies theme <= 1.3.16, unauthenticated PHP object injection, CVSS 9.8, no official patch. Vulnerable endpoint not published. No exploitation or PoC found; did not search social. Patchstack expects mass exploitation.
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112859

## Documents

- [advisory] Patchstack: Little Birdies theme <= 1.3.16 PHP Object Injection https://patchstack.com/database/wordpress/theme/little-birdies/vulnerability/wordpress-little-birdies-theme-1-3-16-php-object-injection-vulnerability
- [describes] CVE record CVE-2026-112859 https://www.cve.org/CVERecord?id=CVE-2026-112859

## From the sources

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_