Description

Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-19T13:18:08.283Z",
  "pubdate": "2026-08-19T13:18:08.283Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the Kalles Addons plugin for WordPress, specifically affecting versions 1.0.6 and prior.\nThis vulnerability arises from the insecure handling of serialized data within the affected component, allowing unauthenticated remote threat actors to supply maliciously crafted input.\nSuccessful exploitation of this flaw can lead to severe security implications, including potential remote code execution, arbitrary file deletion, or sensitive data disclosure depending on the availability of compatible gadget chains within the application environment.\nThe attack vector requires network access to the target WordPress installation, but demands no prior authentication or user privileges, significantly lowering the barrier to entry for malicious actors.\nGiven the nature of PHP Object Injection, organizations utilizing vulnerable versions of Kalles Addons face immediate risk of complete system compromise if exploitable classes are present in the PHP object scope.",
  "technicalDetails": "The root cause of the vulnerability stems from the insecure deserialization of untrusted user input within the Kalles Addons plugin.\nSpecifically, the affected component processes data via PHP deserialization functions such as unserialize() without implementing adequate validation, sanitization, or cryptographic integrity checks on the input stream.\nBecause the vulnerability is exposed to unauthenticated users over the network, an attacker can directly interact with vulnerable entry points exposed by the plugin.\nThe attack flow proceeds as follows: First, the attacker identifies a vulnerable parameter or endpoint within Kalles Addons that passes user-supplied data into a deserialization routine.\nNext, the attacker crafts a malicious serialized payload containing a specific sequence of serialized PHP objects, often leveraging existing classes (gadgets) within the WordPress core, PHP application framework, or other installed plugins and themes.\nUpon transmission of the crafted HTTP request to the target server, the vulnerable component processes the payload and executes the unserialize() function.\nThis action instantiates the attacker-controlled objects within the PHP runtime environment, automatically triggering magic methods such as __wakeup() or __destruct() defined within the injected gadget classes.\nBy chaining these magic methods together, the attacker can manipulate application logic, achieve arbitrary code execution under the privileges of the web server user, or perform unauthorized file operations.\nThe vulnerability affects Kalles Addons versions 1.0.6 and below, requires zero authentication or privilege levels, and exposes the underlying web server to critical post-exploitation risks."
}