What is the CVSS score of EUVD-2026-62390?

EUVD-2026-62390 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Kalles Addons are affected by EUVD-2026-62390?

The WordPress Kalles Addons plugin (version 1.0.6 and earlier) contains a critical unauthenticated vulnerability allowing remote attackers to inject malicious PHP objects and achieve full site…

How to fix or mitigate EUVD-2026-62390?

Within 24 hours: audit all WordPress installations for Kalles Addons plugin through version 1.0.6 and immediately disable or remove the affected plugin to eliminate the attack vector; implement Web Application Firewall rules blocking PHP object injection patterns. Within 7 days: forensically review access logs and error logs for exploitation attempts, and configure real-time alerting for suspicious deserialization activity. Within 30 days: monitor Patchstack and the plugin vendor's advisory channels for security updates; when a patched version is released, test thoroughly in staging and deploy production-wide-no vendor-released patch identified at time of analysis.

Kalles Addons EUVD-2026-62390

| CVE-2026-73389 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-19 Patchstack

GHSA-m7jf-qrf9-6rj3

PHP WordPress Deserialization Wordpress Plugin Kalles Addons

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote deserialization with no user interaction (AV:N/AC:L/PR:N/UI:N); a reachable gadget chain yields full C/I/A impact, matching the reported 9.8.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 13:21 vuln.today

CVE Published

Aug 19, 2026 - 12:38 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

Articles & Coverage 1

News Critical PHP Object Injection in WordPress Kalles Addons Plugin - CVE-2026-73389 Aug 20, 2026

AnalysisAI

Unauthenticated PHP Object Injection in the WordPress 'Kalles Addons' plugin (by the4) through version 1.0.6 lets remote attackers inject arbitrary serialized PHP objects, potentially escalating to code execution, data theft, or site takeover if a suitable gadget chain is present. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-authentication, low-complexity exploitation with full confidentiality, integrity, and availability impact. Disclosed via Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-502 (Deserialization of Untrusted Data) flaw, mapped to PHP Object Injection. It arises when attacker-controlled input reaches PHP's unserialize() (or an equivalent deserialization path) without validation, allowing instantiation of arbitrary PHP objects. On WordPress, such injected objects become dangerous when a 'gadget' - a class with exploitable magic methods (__wakeup, __destruct, __toString) - exists in the plugin, theme, or core, enabling property-oriented programming chains. Kalles Addons is an add-on plugin (CPE cpe:2.3:a:the4:kalles_addons) commonly paired with the4's Kalles WooCommerce theme; the affected component is any endpoint accepting serialized data. The realized impact depends on which gadget chains are loadable in a given installation.

RemediationAI

Upgrade Kalles Addons to a version later than 1.0.6 once the vendor (the4) releases a patched build; the input data does not specify an exact fixed version, so no vendor-released patch version is independently confirmed - verify the latest release via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/kalles-addons/vulnerability/wordpress-kalles-addons-plugin-1-0-6-php-object-injection-vulnerability?_s_id=cve) and the WordPress plugin repository before deploying. Until a fix is confirmed, compensating controls include deploying a WordPress-aware WAF (Patchstack or equivalent) with a virtual patch/rule blocking serialized PHP object payloads (patterns like O:, a:, and __PHP_Incomplete_Class) to the plugin's endpoints, restricting or disabling the vulnerable plugin if it is not business-critical (trade-off: loss of the addon's storefront features), and monitoring access logs for suspicious serialized data in request parameters. If patching is not immediately possible and the plugin's functionality is dispensable, deactivating it is the most reliable mitigation.