CVE-2026-112859

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

ThemeREX Group Little Birdies

Open in Threatline Record JSON

CVSS

9.8Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed inNone listedNo source names a fixed version yet

Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@stackflag.bsky.social: CVE-2026-112859 - little birdies The Little Birdies WordPress theme up to version 1.3.16 can be fooled into processing crafted data, which may let an attacker execute code on your Bluesky: CVE posts, 23 Oct 2026

Description

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

Text from CVE List

Affected versions 1

Little Birdiesaffected: all versions through 1.3.16CVE List

References 1

patchstack.com/database/wordpress/theme/little-birdies/vulnerability/wordpress-little-birdies-theme-1-3-16-php-object-injection-vulnerability?_s_id=cveReferencevia CVE List