CVE-2026-78572

The Kalles Addons plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input, affecting all versions up to 1.0.6. While the vulnerability itself does not pose a direct threat, it can be exploited if a vulnerable plugin or theme containing a PHP Object Injection (POP) chain is present, potentially allowing attackers to delete files, access sensitive data, or execute arbitrary code. WordPress site administrators using this plugin, especially those with additional plugins or themes that may contain a POP chain, should prioritize patching to mitigate the risk.