CVE-2026-78572— Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injection
Quick assessment
Affected
unknown Kalles Addons
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Kalles Addons 插件在所有版本（包括 1.0.6 及更早版本）中存在 PHP 对象注入漏洞，该漏洞源于对不受信任输入的反序列化操作。此漏洞使未认证的攻击者能够注入 PHP 对象。然而，受影响软件本身并不存在已知的 POP（Property-Oriented Programming，面向属性编程）链，因此该漏洞在无其他包含 POP 链的插件或主题安装于站点时，不会产生实际影响。 若目标系统中安装了其他插件或主题，且其中包含可利用的 POP 链，则攻击者可能借助该 POP 链实施危险
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78572
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injection
Source: CVE Program / CVE List V5
Vulnerability Description
The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| unknown | Kalles Addons | 0 ~ 1.0.6 | - |
|
II. Public POCs for CVE-2026-78572
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78572
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78572 (1)
Other References for CVE-2026-78572 (1)
IV. Related Vulnerabilities
Same vendor: unknown
-
CVE-2026-77115
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS -
CVE-2026-77116
Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup -
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capabilit -
CVE-2026-14853
WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Pr -
CVE-2026-13598
RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation
Same weakness: CWE-502
-
CVE-2026-79657
NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle D -
CVE-2026-56095
Insecure Deserialization in extension "Apache Solr for TYPO3 -
CVE-2026-77138
Remote Code Execution in extension "HTML5 Video Player vs. P -
CVE-2026-78683
NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle D -
CVE-2026-78265
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object
V. Comments for CVE-2026-78572
No comments yet