CVE-2026-73389: WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

Q: Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior privileges. The supplied vector indicates it can be reached over the network with low attack complexity and no user interaction.

Q: Which installations are affected?

WordPress sites using Kalles Addons version 1.0.6 or earlier are affected according to the provided data. The information does not identify any configuration requirement or mitigation for unpatched installations.

Q: What is the potential impact?

The vulnerability is rated critical with a 9.8 CVSS score. The provided impact metrics indicate high potential impact to confidentiality, integrity, and availability.

Published Aug 19, 2026

Updated

Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

Affected Software

1 affected component

WordPress Kalles Addons<=1.0.6

Event History

Aug 19, 2026

CVE Published

via MITRE·12:38 PM

Data Sourced

via MITRE·12:38 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior privileges. The supplied vector indicates it can be reached over the network with low attack complexity and no user interaction.

Which installations are affected?

WordPress sites using Kalles Addons version 1.0.6 or earlier are affected according to the provided data. The information does not identify any configuration requirement or mitigation for unpatched installations.

What is the potential impact?