{"id":"CVE-2026-62076","published":"2026-10-10T20:16:42.023","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/kalles/vulnerability/wordpress-kalles-theme-1-1-7-1-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A PHP object injection vulnerability exists in Kalles versions up to 1.1.7.1 that allows unauthenticated attackers to inject arbitrary PHP objects into the application's deserialization process. This flaw can lead to remote code execution, data compromise, and full system takeover.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and leverages a deserialization vulnerability in the application's handling of user-supplied data, making it highly suitable for automated attacks.","blast_radius":"The impact could be severe across all installations running vulnerable versions, potentially allowing attackers to execute arbitrary code on the server, access sensitive data, and establish persistent backdoors.","remediation":"Upgrade to Kalles version 1.1.7.2 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:47:16.479Z"}}