The Kalles WordPress theme is vulnerable to unauthenticated PHP Object Injection through deserialization of untrusted data (CWE-502). An attacker can craft malicious serialized payloads that, when processed by the theme, can lead to arbitrary code execution on the web server. This gives full control over the affected site, allowing data theft, defacement, or further exploitation. The impact is severe, affecting confidentiality, integrity, and availability of the compromised environment.

All WordPress installations using the Kalles theme version 1.1.7.1 or earlier are affected. The vendor identified as The4 is responsible for the theme. No other products or versions are listed as affected by this vulnerability.

The CVSS score of 9.8 indicates a critical vulnerability. The EPSS score is not available, but the lack of a KEV listing does not diminish the seriousness; exploitation of PHP Object Injection is well documented. The vulnerability is attacker‑controllable without authentication, meaning any external user can trigger the payload by sending a crafted request to the site. Once executed, the attacker can run arbitrary code with the privileges of the web server process.