PHP Object Injection in Kalles Addons for WordPress

The Kalles Addons plugin for WordPress, in versions up to and including 1.0.6, contains a critical vulnerability involving the insecure deserialization of untrusted input. An unauthenticated attacker can supply a serialized PHP object to specific input vectors processed by the plugin, leading to PHP Object Injection. While the plugin itself lacks an embedded Property Oriented Programming (POP) chain, the vulnerability is highly significant for environments that host multiple plugins or themes. If a secondary, vulnerable, or complex component is present on the same WordPress instance, an attacker can leverage its existing POP chain to achieve arbitrary file deletion, data exfiltration, or remote code execution. Because this vulnerability originates from the plugin's handling of user-supplied data, detection must focus on identifying suspicious input patterns in web server logs.

Impact

Successful exploitation depends on the existence of a POP chain within the target WordPress site's plugin or theme ecosystem. If such a chain is identified, the attacker can achieve remote code execution (RCE) or escalate privileges to perform unauthorized actions such as deleting sensitive site configuration files or stealing database contents, potentially leading to a full site compromise.

Recommendation

1. Audit all WordPress installations to identify and update the Kalles Addons plugin to a version beyond 1.0.6 or remove the plugin if updates are unavailable.
2. Perform a comprehensive review of all installed themes and plugins to identify potential POP chain gadgets that could be leveraged by this vulnerability.
3. Implement strict input validation at the web application firewall (WAF) level to block requests containing serialized PHP objects directed at the vulnerable endpoints.
4. Review web server access logs for anomalous POST requests containing PHP serialization markers (e.g., O:[0-9]+:).