CVE-2025-5394

The Alone – Charity Multipurpose Non-profit WordPress theme is vulnerable to unauthenticated arbitrary file uploads (CWE-862, missing capability check) in the alone_import_pack_install_plugin() function in all versions up to and including 7.8.3. A remote attacker with no account or privileges can trigger the theme's plugin-install/import routine and supply a zip archive from a remote location, with no authorization check to stop them. By uploading a crafted zip file containing a webshell disguised as a plugin, the attacker achieves remote code execution on the hosting server and can take over the site. Any WordPress site running the Alone theme at version 7.8.3 or earlier is affected; a related flaw tracked as CVE-2025-54019 is likely a duplicate of this issue. Exploitation is already occurring in the wild, with recent reports of attackers hijacking WordPress sites via remote plugin installation, and the elevated EPSS score (52.1% probability within 30 days, 99th percentile) signals continued risk despite no KEV listing or public PoC.

What to do: Update the Alone theme immediately to a version newer than 7.8.3 (the patched release is 7.8.4) and verify that no unknown plugins or rogue administrator users were added. Because exploitation is active, inspect wp-content/plugins and uploads for webshells, review access logs for requests invoking the import-pack install routine, and consider applying WAF rules as a stopgap until patched.