Product
The Kalles Addons plugin for WordPress (<= 1.0.6) is vulnerable to unauthenticated PHP Object Injection, which may allow remote code execution or file operations if a compatible POP chain exists in the environment.