The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data in the WordPress Little Birdies theme. This flaw allows an attacker to instantiate arbitrary PHP objects, potentially leading to execution of arbitrary code or escalation of privileges on the affected host. The weakness is identified as CWE-502, a deserialization of untrusted data vulnerability.

The affected product is the WordPress theme Little Birdies by ThemeREX Group, specifically all releases from the earliest available version up through 1.3.16. Any WordPress installation that has the theme enabled at or below this version is vulnerable.

The CVSS score of 9.8 denotes a critical severity, indicating that exploitation would have a high impact on confidentiality, integrity, and availability. The EPSS score is not available, so the current execution probability is unknown, but the absence of a KEV listing suggests no widespread public exploitation has been documented yet. Attackers would most likely exploit the flaw remotely by crafting a malicious HTTP request that triggers the unchecked deserialization within the theme code. Because the flaw stems from user-provided input, it can be exercised without authentication, raising the attack surface significantly.