Kalles Addons CVE-2026-78572

Exploitation requires two concurrent conditions: (1) the target WordPress site must have the Kalles Addons plugin installed at version 1.0.6 or earlier, and (2) at least one other co-installed plugin or theme must provide a compatible POP chain - a set of exploitable PHP magic methods (__wakeup, __destruct, __toString, etc.) that chain together to produce a dangerous outcome such as file write, file deletion, or code execution. The deserialization call is reachable without authentication (CVSS PR:N, AV:N), but without a POP chain from a secondary component the injection has no impact whatsoever. The exact WordPress input vector - whether a specific POST parameter, REST API endpoint, cookie, or other field - is not disclosed in the available references. Exploitation is bounded by the requirement for a compatible co-installed POP chain provider, which varies entirely by the target site's plugin and theme configuration.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately models the conditional nature of this vulnerability: the High complexity metric reflects the prerequisite of a co-installed POP chain, absent which there is zero exploitable impact regardless of patch status. A WordPress site running only Kalles Addons 1.0.6 is not exploitable in practice; a site also running a plugin or theme that supplies a POP chain - such as a popular page builder, WooCommerce extension, or form plugin - faces full C:H/I:H/A:H exposure. No EPSS score was provided in the input data; with no KEV listing and no confirmed public exploit code, near-term exploitation probability is assessed as moderate-to-low, concentrated on sites whose plugin stack happens to include a known POP chain source. The unauthenticated network vector means automated mass-scanning for this class of vulnerability is feasible, so even sites with a low perceived profile should treat patching as a routine but non-emergency priority rather than a critical incident response.

An unauthenticated remote attacker sends a crafted HTTP request to the WordPress site containing a serialized PHP payload targeting the Kalles Addons plugin's deserialization point. If a co-installed plugin or theme - such as a popular WooCommerce extension or page builder - exposes a usable POP chain, the deserialized object triggers a chain of PHP magic methods resulting in arbitrary file deletion, credential exfiltration from wp-config.php, or remote code execution under the web server user. No public proof-of-concept exploit has been identified at time of analysis, but the unauthenticated network vector makes automated scanning across large numbers of WordPress sites feasible.