CVE-2026-78572: 
WordPress vulnerability analysis and mitigation

CVE-2026-78572 is a PHP Object Injection vulnerability in the Kalles Addons plugin for WordPress, affecting all versions up to and including 1.0.6. It was discovered by João Pedro S Alcântara (Kinorth), reported on February 5, 2026, and published to the GitHub Advisory Database on August 25, 2026. The vulnerability allows unauthenticated attackers to inject arbitrary PHP objects via deserialization of untrusted input, with actual impact contingent on the presence of a usable POP (Property-Oriented Programming) chain from another installed plugin or theme. It carries a CVSS v3.1 base score of 8.1 (High) per NVD, while Patchstack rates it 9.8 (Critical) (GitHub Advisory, Patchstack).

The root cause is improper deserialization of untrusted user-supplied input (CWE-502), which allows an unauthenticated remote attacker to inject a PHP object into the application over the network. The attack vector is network-based with high complexity, requiring no privileges or user interaction, but exploitation depends on the presence of a compatible POP chain in another installed plugin or theme on the same WordPress site. If such a gadget chain exists, the injected object can be leveraged to trigger arbitrary actions defined by the chain, such as file deletion, data exfiltration, or remote code execution. No specific technical write-up or public proof-of-concept code has been identified at this time (GitHub Advisory, Patchstack).

If a compatible POP chain is present via another installed plugin or theme, successful exploitation could allow an unauthenticated attacker to delete arbitrary files, retrieve sensitive data, or execute arbitrary code on the affected WordPress server. This could result in full site compromise, including unauthorized access to the database, exposure of credentials or user data, and potential lateral movement within the hosting environment. In the absence of a usable POP chain, the vulnerability has no direct impact (GitHub Advisory, Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is 0.0, reflecting a currently low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is conditional on the co-presence of a POP chain from another plugin or theme, which raises the effective attack complexity (GitHub Advisory, Patchstack).

1. Reconnaissance: Identify WordPress sites running the Kalles Addons plugin version 1.0.6 or earlier, using tools like WPScan or Shodan to enumerate plugin versions.
2. POP Chain Discovery: Audit other plugins and themes installed on the target site for known PHP gadget chains (e.g., via public vulnerability databases or manual code review) that can be triggered through object injection.
3. Craft Malicious Payload: Construct a serialized PHP object payload that, when deserialized, instantiates a class from the identified POP chain with attacker-controlled property values.
4. Inject Payload: Submit the crafted serialized payload to the vulnerable deserialization endpoint in the Kalles Addons plugin via an unauthenticated HTTP request.
5. Trigger POP Chain: The deserialized object triggers the gadget chain's magic methods (e.g., __wakeup, __destruct), executing the attacker's intended action — such as writing a web shell, deleting files, or exfiltrating data — depending on the chain available (GitHub Advisory, Patchstack).

• Network: Unusual HTTP POST requests to WordPress endpoints associated with the Kalles Addons plugin containing serialized PHP data (e.g., O:<length>:"<classname>" patterns in request bodies or parameters).
• Logs: WordPress or web server access logs showing repeated unauthenticated requests to plugin-specific endpoints with abnormally large or encoded payloads; PHP error logs referencing unexpected class instantiation or deserialization errors.
• File System: Unexpected new PHP files (e.g., web shells) in the WordPress uploads directory or plugin directories; modification timestamps on core files inconsistent with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) indicating potential code execution via a triggered POP chain.

Site administrators should update the Kalles Addons plugin to a version newer than 1.0.6 as soon as a patched release becomes available. In the interim, Patchstack has issued a virtual patching/mitigation rule to block exploitation attempts for subscribers of their service. Additionally, administrators should audit all installed plugins and themes for known POP chains that could be leveraged in conjunction with this vulnerability, and remove or update any that are unnecessary or outdated. Implementing a web application firewall (WAF) rule to block serialized PHP object payloads in HTTP requests is also recommended as a defense-in-depth measure (GitHub Advisory, Patchstack).

Patchstack, which credited researcher João Pedro S Alcântara (Kinorth) with the discovery, has classified this as high priority and issued a virtual mitigation rule ahead of an official patch. Wordfence has also catalogued the vulnerability in their threat intelligence database. No significant broader media coverage or notable social media commentary has been identified at this time (Patchstack, GitHub Advisory).