{"id":"CVE-2026-112859","published":"2026-10-23T13:17:07.700","lastModified":"2026-10-24T15:17:09.507","description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/little-birdies/vulnerability/wordpress-little-birdies-theme-1-3-16-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Little Birdies plugin for WordPress prior to version 1.3.16 contains a deserialization vulnerability (CWE-502) that allows attackers to inject and execute arbitrary PHP objects via unsanitized user-controlled data, leading to remote code execution or other serious impacts.","exploitability":"Exploitation is straightforward for remote attackers since it requires no authentication, user interaction, or special conditions—only the ability to send a crafted request to an affected endpoint.","blast_radius":"Successful exploitation could lead to full system compromise including data exfiltration, unauthorized code execution, and potential lateral movement within the WordPress environment.","remediation":"Upgrade to Little Birdies version 1.3.17 or later, as this is the first fixed version following the affected range (through 1.3.16).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","object-injection","php","wordpress-plugin"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:44:12.317Z"}}