Little Birdies
Monthly
PHP object injection in ThemeREX Group's Little Birdies WordPress theme, affecting all versions through 1.3.16, lets unauthenticated remote attackers feed attacker-controlled serialized data into an unsafe deserialization sink reachable over the network, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity and availability impact in the assessed worst case. The realistic ceiling depends on gadget availability: object injection only escalates to code execution or comparable compromise where a usable POP chain exists in the theme, an installed plugin or WordPress core, and without one the practical impact may be well below the headline rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the vendor-neutral Patchstack disclosure and the act_now priority label make this a patch-now item for any site running the theme.
PHP object injection in ThemeREX Group's Little Birdies WordPress theme, affecting all versions through 1.3.16, lets unauthenticated remote attackers feed attacker-controlled serialized data into an unsafe deserialization sink reachable over the network, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity and availability impact in the assessed worst case. The realistic ceiling depends on gadget availability: object injection only escalates to code execution or comparable compromise where a usable POP chain exists in the theme, an installed plugin or WordPress core, and without one the practical impact may be well below the headline rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the vendor-neutral Patchstack disclosure and the act_now priority label make this a patch-now item for any site running the theme.