Critical · 9.8 CVE-2026-112859 EUVD-2026-108944GHSA-8xhm-xwwm-cmm8

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

Published Oct 23, 2026 · Updated Oct 24, 2026 · Assigned by Patchstack

Vendor: ThemeREX Product: Little Birdies

Description

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

Affected products

Vendor	Product	Affected	Fixed
ThemeREX Group	Little Birdies	≤ 1.3.16	—

References

https://patchstack.com/database/wordpress/theme/little-birdies/vulnerability/wordpress-little-birdies-theme-1-3-16-php-object-injection-vulnerability?_s_id=cve vdb-entry