CVE-2026-78572

Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7

Description The Kalles Addons plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The impact of this issue depends on the presence of a POP chain (a sequence of gadgets used to achieve code execution or other malicious actions) within other installed plugins or themes. If such a chain exists, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations Update the plugin to a version later than 1.0.6.