Little Birdies EUVD-2026-108944

The flaw is PHP Object Injection via deserialization of untrusted data (CWE-502) in the Little Birdies theme, versions up to and including 1.3.16. Exploitation requires the attacker to deliver attacker-controlled serialized data to the vulnerable deserialization sink; the specific feature, parameter, or endpoint is not described in the available sources. The realistic impact LIMIT is gadget-chain dependency: object injection only escalates to code execution or significant compromise when a usable POP gadget chain is present in the theme, an installed plugin, or WordPress core - without one, impact may be substantially lower than the 9.8 rating implies. The CVSS vector indicates PR:N/UI:N (no authentication or user interaction required against affected installations), but authentication specifics beyond the vector are not confirmed from the evidence.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical, describing a network-reachable flaw requiring no privileges or user interaction, with full confidentiality, integrity, and availability impact. The vuln.today Decision label is 'act_now', aligning with the Critical score. However, several decision signals are MISSING: no EPSS probability was provided, the vulnerability is NOT listed in CISA KEV (no confirmed active exploitation), and no SSVC exploitation/automatable/technical-impact breakdown was supplied. The only reference is the Patchstack database advisory, which is a vendor report, not working exploit code. In practice, CWE-502 PHP Object Injection in WordPress code only reaches full RCE/CVSS-9.8 impact when a usable POP gadget chain exists in the theme, a loaded plugin, or WordPress core; the supplied evidence does not describe the trigger or confirm a reachable gadget chain, so the headline score represents worst-case potential rather than demonstrated impact. Weighing these signals: the Critical rating and 'act_now' label justify prioritized patching, but absent EPSS, KEV, or PoC confirmation, this reads as a high-severity issue in a low-prevalence product rather than evidence of widespread exploitation.

A remote attacker submits crafted serialized PHP data to an input the Little Birdies theme deserializes, injecting a malicious object. If a suitable property-oriented programming (POP) gadget chain is present in the theme, an installed plugin, or WordPress core, the injected object can be leveraged for outcomes up to remote code execution or data compromise. No working exploit code is referenced, and the exact trigger is not described in the available sources.