CVE-2026-78572: Kalles Addons WordPress Plugin RCE Flaw

CVE-2026-78572 Overview

CVE-2026-78572 is a PHP Object Injection vulnerability in the Kalles Addons plugin for WordPress. The flaw affects all versions up to and including 1.0.6. Unauthenticated attackers can inject a PHP object through deserialization of untrusted input. The vulnerable code path processes attacker-controlled serialized data without validation.

The plugin itself does not contain a Property-Oriented Programming (POP) chain. However, if another installed plugin or theme provides a POP chain, attackers can chain the injection to delete arbitrary files, retrieve sensitive data, or execute code. This vulnerability is classified under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Unauthenticated attackers can inject PHP objects that, when combined with a POP chain from another installed component, lead to arbitrary file deletion, data disclosure, or remote code execution.

Affected Products

Kalles Addons plugin for WordPress — all versions through 1.0.6
WordPress sites running Kalles Addons alongside plugins or themes containing exploitable POP chains
WordPress installations exposing the plugin's vulnerable deserialization endpoint to the network

Discovery Timeline

2026-08-25 - CVE-2026-78572 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78572

Vulnerability Analysis

The Kalles Addons plugin passes untrusted input to a PHP deserialization routine such as unserialize(). When PHP deserializes attacker-controlled data, it reconstructs objects and invokes magic methods like __wakeup(), __destruct(), or __toString() on those objects. An attacker who controls the serialized payload controls which classes get instantiated and which properties those objects hold.

On its own, the plugin does not expose a usable gadget chain. The exploitation impact depends entirely on other code loaded in the WordPress runtime. WordPress environments commonly load dozens of plugins and themes, increasing the likelihood that a suitable POP chain is available. Public gadget catalogs such as PHPGGC document reusable chains against WordPress components.

Successful exploitation may yield arbitrary file deletion via destructor-driven cleanup logic, sensitive data disclosure through __toString() gadgets, or remote code execution when a chain reaches call_user_func, eval(), or file inclusion sinks.

Root Cause

The root cause is the direct deserialization of attacker-supplied input without prior validation, integrity checks, or use of a safe format such as JSON. PHP's native unserialize() treats input as authoritative object state, which is unsafe when the source is untrusted.

Attack Vector

The attack is remote and requires no authentication or user interaction. Attack complexity is elevated because a working POP chain must exist in the target's plugin or theme stack. An attacker sends a crafted serialized payload to the vulnerable request handler, and PHP instantiates the attacker-chosen classes during deserialization.

No verified public exploit code is available at this time. For technical details, see the Wordfence vulnerability analysis and the Patchstack advisory.

Detection Methods for CVE-2026-78572

Indicators of Compromise

HTTP requests containing serialized PHP patterns such as O: (object), a: (array), or s: (string) in query parameters, POST bodies, or cookies targeting Kalles Addons endpoints.
Unexpected PHP error log entries referencing unserialize(), __wakeup, __destruct, or class instantiation failures.
Unexplained file deletions, new files under wp-content/uploads/, or modifications to plugin and theme PHP files.
Outbound network connections from the web server process to attacker infrastructure following suspicious POST requests.

Detection Strategies

Inspect web server access logs for requests to Kalles Addons routes containing URL-encoded serialized object signatures.
Deploy WordPress-aware Web Application Firewall (WAF) rules that flag serialized PHP object payloads in request parameters.
Monitor PHP process behavior for anomalous file operations, exec-family syscalls, or child process creation originating from php-fpm or the web server user.
Correlate WordPress plugin inventory with public POP chain databases to identify combinations that elevate exploitability.

Monitoring Recommendations

Enable PHP error logging and forward logs to a centralized SIEM for pattern matching on deserialization errors.
Track file integrity across wp-content/plugins/, wp-content/themes/, and wp-config.php to detect tampering.
Alert on new administrative user creation, unexpected cron job modifications, and changes to .htaccess files.

How to Mitigate CVE-2026-78572

Immediate Actions Required

Identify all WordPress sites running Kalles Addons at version 1.0.6 or earlier and prioritize them for remediation.
Deactivate the Kalles Addons plugin until a patched version is confirmed installed if the site cannot be updated immediately.
Audit the plugin and theme inventory on affected sites to identify components known to expose POP chains.
Restrict network access to WordPress administrative and plugin endpoints using IP allowlists or a WAF.

Patch Information

At the time of publication, no fixed version is listed in the enriched CVE data. Consult the Patchstack advisory and the Wordfence entry for the latest vendor guidance and patched release information.

Workarounds

Remove or disable the Kalles Addons plugin until a patched version is available.
Deploy WAF signatures that reject requests containing serialized PHP object markers on plugin endpoints.
Remove unused plugins and themes to reduce the pool of code that could supply a POP chain.
Run WordPress with least-privilege file system permissions so the web server cannot modify plugin, theme, or core files.

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate kalles-addons
wp plugin list --status=active --format=table

# Optional: block serialized PHP object payloads at the reverse proxy (example: nginx)
# Reject request bodies containing common PHP object serialization markers
# location ~ /wp-content/plugins/kalles-addons/ {
#     if ($request_body ~* "(^|[^a-z])O:[0-9]+:\"") { return 403; }
# }