PT-2026-23401 · Axiomthemes · Little Birdies

Tran Nguyen Bao Khanh · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-28129

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions axiomthemes Little Birdies versions through 1.3.16

Description The software contains an Improper Control of Filename for Include/Require Statement issue, also known as a PHP Remote File Inclusion. This allows for PHP Local File Inclusion. The number of potentially affected devices is not specified. There are no details about real-world incidents where this issue was exploited. The issue relates to how the software handles file inclusion, potentially allowing an attacker to include and execute arbitrary files.

Recommendations Update axiomthemes Little Birdies to a version later than 1.3.16.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-28129

Affected Products

Little Birdies

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-28129 · Security Note
• https://twitter.com/TheHackerWire/status/2029587743018484091 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/little-birdies/vulnerability/wordpress-little-birdies-theme-1-3-16-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2029454832210468960 · Twitter Post