External risk intelligence

Kalles Addons PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73389

The vulnerability affects a WordPress plugin, which is typically deployed as part of an internet-facing web application. As a plugin, it processes web requests directly, making it commonly accessible to public internet traffic in standard website deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Kalles Addons that could allow unauthenticated attackers to inject malicious code. This issue impacts systems using this specific plugin, and its severity suggests a high potential for compromise if exploited. The primary concern is to confirm if this plugin is in use and assess any potential exposure.

Allows unauthorized code injection.
Matters due to potential widespread impact.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending a crafted request to a web application that uses the Kalles Addons plugin. This request would target the plugin's handling of PHP objects, potentially allowing the attacker to inject malicious code and execute it on the server.

Requires no authentication.
Triggered by a specially crafted request.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated PHP Object Injection in Kalles Addons could allow an attacker to inject arbitrary PHP objects into the application. When supported by the advisory, this may lead to the execution of malicious code, allowing an attacker to potentially take control of the affected system.

System data and service behavior at risk.
Via unauthenticated injection of PHP objects.
Remote code execution and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP Object Injection vulnerability in Kalles Addons affects internet-facing web applications, suggesting that platform or web application teams are likely responsible for managing the plugin. The first practical step is to identify all instances of the affected plugin, assess their exposure and business criticality, and then plan remediation or temporary risk reduction strategies.

Application owners should address this issue.
Verify plugin reachability and impact.
Plan remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Kalles Addons?

Kalles Addons is a WordPress plugin designed to extend the functionality of sites using the Kalles theme. It provides specific features and structural elements to help manage page layouts and site components. Because it acts as an extension within the WordPress ecosystem, it processes incoming data and user requests, which is where the vulnerability resides.

What does PHP Object Injection mean for CVE-2026-73389?

This vulnerability falls under the Weakness Class CWE-502, which concerns insecure deserialization. In simple terms, the plugin incorrectly handles user-supplied data formatted as a PHP object. An attacker can supply a malicious object that the plugin blindly trusts and processes, effectively tricking the system into executing unauthorized instructions or altering its normal behavior.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted network request to the web application. Because the plugin fails to validate input before processing it, no prior login or administrative credentials are required. Note that this is not triggered by standard site navigation; it requires a targeted, manipulated request specifically designed to exploit the object handling flaw.

Is my site at risk from CVE-2026-73389?

According to Halo Surface Signal, the risk is elevated because this is a WordPress plugin, which is typically part of an internet-facing web application. Since the plugin processes web traffic directly, it is generally accessible to anyone on the public internet. If your site runs a vulnerable version, it is reachable by external actors.

Do I need to take immediate action if I use Kalles Addons?

Yes. Start by creating an inventory to identify every instance of the plugin currently in use. Once identified, evaluate the importance of those sites to your operations. While planning for a permanent update or removal, check if you can restrict access to the affected site components or temporarily disable the plugin to reduce your risk profile.

References

patchstack.com/database/wordpress/plugin/kalles-addons/vulnerability…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.