The Kalles Addons plugin for WordPress allows an attacker to send data that is deserialized without validation. This vulnerability is unauthenticated and enables the creation of arbitrary PHP objects. No exploitation chain exists inside the plugin itself, so the flaw alone cannot execute code. However, if the target site contains another plugin or theme that implements a PHP Object Injection (POP) chain, the attacker could leverage this flaw to instantiate dangerous objects and then exploit the POP chain. Through such a chain an attacker could delete files, read sensitive data, or run arbitrary code on the server.

Any WordPress installation that has the Kalles Addons plugin version 1.0.6 or older installed is affected. The plugin is distributed under the unknown:Kalles Addons vendor identifier and is available from the WordPress plugin repository.

The vulnerability has a CVSS score of 8.1, indicating a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the plugin does not contain a Standalone POP chain, exploitation requires that the target site also hosts another plugin or theme that contains a compatible POP chain. If such a chain is present, the attacker can achieve code execution or other destructive actions. If no POP chain exists, the flaw has no direct impact.