The4 Kalles Addons versions <= 1.0.6 suffer from an unauthenticated PHP object injection vulnerability caused by unsafe deserialization of untrusted data (CWE-502). This vulnerability allows remote attackers to execute arbitrary code without authentication, leading to full compromise of the affected system. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation results in remote code execution with full control over the affected system, impacting confidentiality, integrity, and availability. Since no authentication is required, the attack surface is broad, making this a critical risk for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and monitor for suspicious activity. Avoid exposing the vulnerable service to untrusted networks.