Mmastodon TechnologyCybersecurity first seen 19 h ago, last 19 h ago, peak #5

Critical unauthenticated PHP object injection flaw found in Kalles theme

Original: 🚨 EUVD-2026-96488 📊 Score: 9.8/10 (CVSS v3.1) 📦 Product: Kalles 🏢 Vendor: The4 📅 Updated: 2026-10-10 📝 Unauthenticated P

A critical vulnerability, tracked as EUVD-2026-96488, has been published for Kalles, an e-commerce theme by vendor The4. The flaw is described as an unauthenticated PHP object injection, meaning attackers would not need credentials to exploit it. It carries a CVSS v3.1 severity score of 9.8 out of 10, placing it in the critical range. The advisory was updated on 10 October 2026, and site operators using Kalles are being urged to check for patches.

Why now: Security communities are highlighting the advisory because a maximum-severity, remotely exploitable flaw in a widely used e-commerce theme poses immediate risk to online stores.

KallesThe4ENISAEUVD-2026-96488

Open on mastodon →

Evidence

• 🚨 EUVD-2026-96488 📊 Score: 9.8/10 (CVSS v3.1) 📦 Product: Kalles 🏢 Vendor: The4 📅 Updated: 2026-10-10 📝 Unauthenticated PHP Object Injection in Kalles 🔗 https:// euvd.enisa.europa.eu/vulnerabi lity/EUVD-2026-96488 # cybersecurity # infosec # euvd # cve # vulnerability · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/1777492