Attackers actively exploit critical zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-5394 | Unauthenticated Arbitrary File Upload to RCE in Alone WordPress Theme The Alone – Charity Multipurpose Non-profit WordPress theme is vulnerable to unauthenticated arbitrary file uploads (CWE-862, missing capability check) in the alone_import_pack_install_plugin() function in all versions up to and including 7.8.3. A remote attacker with no account or privileges can trigger the theme's plugin-install/import routine and supply a zip archive from a remote location, with no authorization check to stop them. By uploading a crafted zip file containing a webshell disguised as a plugin, the attacker achieves remote code execution on the hosting server and can take over the site. Any WordPress site running the Alone theme at version 7.8.3 or earlier is affected; a related flaw tracked as CVE-2025-54019 is likely a duplicate of this issue. Exploitation is already occurring in the wild, with recent reports of attackers hijacking WordPress sites via remote plugin installation, and the elevated EPSS score (52.1% probability within 30 days, 99th percentile) signals continued risk despite no KEV listing or public PoC. Do: Update the Alone theme immediately to a version newer than 7.8.3 (the patched release is 7.8.4) and verify that no unknown plugins or rogue administrator users were added. Because exploitation is active, inspect wp-content/plugins and uploads for webshells, review access logs for requests invoking the import-pack install routine, and consider applying WAF rules as a stopgap until patched. | 9.8 | 52% |
| niche~4,000-5,000 sites (premium ThemeForest theme with a few thousand sales) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 193.84.71.244 | r 120,900 exploit attempts. Several IP addresses, including 193.84.71.244 and 87.120.92.24, are responsible for tens of thousands of |
| ipv4 | 87.120.92.24 | attempts. Several IP addresses, including 193.84.71.244 and 87.120.92.24, are responsible for tens of thousands of malicious request |
Full article384 words · extracted from securityaffairs.com · click to collapse
Hackers exploit a critical vulnerability, tracked as CVE-2025-5394 (CVSS score of 9.8), in the Alone WordPress theme to hijack sites.
Threat actors are actively exploiting a critical flaw, tracked as CVE-2025-5394 (CVSS score of 9.8), in the “Alone – Charity Multipurpose Non-profit WordPress Theme” to compromise websites.
On May 30th, 2025, security researcher Thái An reported the bug via WordPress security firm Wordfence.
“This vulnerability makes it possible for an unauthenticated attacker to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover.” reads the advisory published by Wordfence.
The issue is an Arbitrary File Upload via Plugin Installation vulnerability in the Alone theme, which has more than 9,000 installations.
The flaw was exploited as zero-day, its exploitation began before public disclosure on July 14, 2025. The flaw impacts Alone theme versions up to 7.8.3, it was addressed on June 16 in version 7.8.5.
“According to our data, attackers started targeting websites on July 12th, before the vulnerability was publicly disclosed, on July 14th. A clear indication that attackers are monitoring changesets and software for newly patched vulnerabilities.” continues the report.
The researchers examined the theme code and discovered that the alone_import_pack_install_plugin() function in the Alone WordPress theme lacked capability and nonce checks, allowing unauthenticated users to access it via the wp_ajax_nopriv hook. This allowed attackers to install plugins using remote sources by sending crafted requests, leading to arbitrary file uploads and potential remote code execution. In effect, the flaw enabled full site takeover through unauthorized plugin installation.
Since the vendor patched the flaw, Wordfence has blocked over 120,900 exploit attempts. Several IP addresses, including 193.84.71.244 and 87.120.92.24, are responsible for tens of thousands of malicious requests targeting the Alone theme.
In the attacks blocked by Wordfence, threat actors exploit the flaw to upload ZIP files like “wp-classic-editor.zip” containing PHP backdoors. These let them run remote commands, upload more files, and even install full file managers or hidden admin accounts, giving them full control over the site.
WordPress site admins using the Alone theme should update to the latest version, check for suspicious admin accounts, and scan logs for requests to /wp-admin/admin-ajax.php?action=alone_import_pack_install_plugin.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Alone WordPress theme)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/180630/hacking/attackers-actively-exploit-critical-zero-day-in-alone-wordpress-theme.html