Hackers Exploit Critical WordPress Theme Flaw to Hijack Sites via Remote Plugin Install
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-5394 | Unauthenticated Arbitrary File Upload to RCE in Alone WordPress Theme The Alone – Charity Multipurpose Non-profit WordPress theme is vulnerable to unauthenticated arbitrary file uploads (CWE-862, missing capability check) in the alone_import_pack_install_plugin() function in all versions up to and including 7.8.3. A remote attacker with no account or privileges can trigger the theme's plugin-install/import routine and supply a zip archive from a remote location, with no authorization check to stop them. By uploading a crafted zip file containing a webshell disguised as a plugin, the attacker achieves remote code execution on the hosting server and can take over the site. Any WordPress site running the Alone theme at version 7.8.3 or earlier is affected; a related flaw tracked as CVE-2025-54019 is likely a duplicate of this issue. Exploitation is already occurring in the wild, with recent reports of attackers hijacking WordPress sites via remote plugin installation, and the elevated EPSS score (52.1% probability within 30 days, 99th percentile) signals continued risk despite no KEV listing or public PoC. Do: Update the Alone theme immediately to a version newer than 7.8.3 (the patched release is 7.8.4) and verify that no unknown plugins or rogue administrator users were added. Because exploitation is active, inspect wp-content/plugins and uploads for webshells, review access logs for requests invoking the import-pack install routine, and consider applying WAF rules as a stopgap until patched. | 9.8 | 52% |
| niche~4,000-5,000 sites (premium ThemeForest theme with a few thousand sales) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 146.19.213.18 | rom the following IP addresses - 193.84.71.244 87.120.92.24 146.19.213.18 185.159.158.108 188.215.235.94 146.70.10.25 74.118.126.111 |
| ipv4 | 146.70.10.25 | 4 87.120.92.24 146.19.213.18 185.159.158.108 188.215.235.94 146.70.10.25 74.118.126.111 62.133.47.18 198.145.157.102 2a0b:4141:820:7 |
| ipv4 | 185.159.158.108 | ing IP addresses - 193.84.71.244 87.120.92.24 146.19.213.18 185.159.158.108 188.215.235.94 146.70.10.25 74.118.126.111 62.133.47.18 198 |
| ipv4 | 188.215.235.94 | - 193.84.71.244 87.120.92.24 146.19.213.18 185.159.158.108 188.215.235.94 146.70.10.25 74.118.126.111 62.133.47.18 198.145.157.102 2a |
| ipv4 | 193.84.71.244 | e activity has originated from the following IP addresses - 193.84.71.244 87.120.92.24 146.19.213.18 185.159.158.108 188.215.235.94 1 |
| ipv4 | 198.145.157.102 | 108 188.215.235.94 146.70.10.25 74.118.126.111 62.133.47.18 198.145.157.102 2a0b:4141:820:752::2 In the observed attacks, the flaw is a |
| ipv4 | 62.133.47.18 | 185.159.158.108 188.215.235.94 146.70.10.25 74.118.126.111 62.133.47.18 198.145.157.102 2a0b:4141:820:752::2 In the observed attack |
| ipv4 | 74.118.126.111 | 4 146.19.213.18 185.159.158.108 188.215.235.94 146.70.10.25 74.118.126.111 62.133.47.18 198.145.157.102 2a0b:4141:820:752::2 In the ob |
| ipv4 | 87.120.92.24 | originated from the following IP addresses - 193.84.71.244 87.120.92.24 146.19.213.18 185.159.158.108 188.215.235.94 146.70.10.25 7 |
Full article330 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 31, 2025Vulnerability / Website Security
Threat actors are actively exploiting a critical security flaw in "Alone – Charity Multipurpose Non-profit WordPress Theme" to take over susceptible sites.
The vulnerability, tracked as CVE-2025-5394, carries a CVSS score of 9.8. Security researcher Thái An has been credited with discovering and reporting the bug.
According to Wordfence, the shortcoming relates to an arbitrary file upload affecting all versions of the plugin prior to and including 7.8.3. It has been addressed in version 7.8.5 released on June 16, 2025.
CVE-2025-5394 is rooted in a plugin installation function named "alone_import_pack_install_plugin()" and stems from a missing capability check, thereby allowing unauthenticated users to deploy arbitrary plugins from remote sources via AJAX and achieve code execution.
"This vulnerability makes it possible for an unauthenticated attacker to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover," Wordfence's István Márton said.
Evidence shows that CVE-2025-5394 began to be exploited starting July 12, two days before the vulnerability was publicly disclosed. This indicates that the threat actors behind the campaign may have been actively monitoring code changes for any newly addressed vulnerabilities.
The company said it has already blocked 120,900 exploit attempts targeting the flaw. The activity has originated from the following IP addresses -
- 193.84.71.244
- 87.120.92.24
- 146.19.213.18
- 185.159.158.108
- 188.215.235.94
- 146.70.10.25
- 74.118.126.111
- 62.133.47.18
- 198.145.157.102
- 2a0b:4141:820:752::2
In the observed attacks, the flaw is averaged to upload a ZIP archive ("wp-classic-editor.zip" or "background-image-cropper.zip") containing a PHP-based backdoor to execute remote commands and upload additional files. Also delivered are fully-featured file managers and backdoors capable of creating rogue administrator accounts.
To mitigate any potential threats, WordPress site owners using the theme are advised to apply the latest updates, check for any suspicious admin users, and scan logs for the request "/wp-admin/admin-ajax.php?action=alone_import_pack_install_plugin."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/07/hackers-exploit-critical-wordpress.html