CVE-2026-112859

Summary

The Little Birdies plugin for WordPress prior to version 1.3.16 contains a deserialization vulnerability (CWE-502) that allows attackers to inject and execute arbitrary PHP objects via unsanitized user-controlled data, leading to remote code execution or other serious impacts.

Exploitability

Exploitation is straightforward for remote attackers since it requires no authentication, user interaction, or special conditions—only the ability to send a crafted request to an affected endpoint.

Blast radius

Successful exploitation could lead to full system compromise including data exfiltration, unauthorized code execution, and potential lateral movement within the WordPress environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Little Birdies version 1.3.17 or later, as this is the first fixed version following the affected range (through 1.3.16).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.