CVE-2025-5394

Published Jul 15, 2025

Last updated 2 months ago

WordPress

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-5394 is a vulnerability affecting the Alone – Charity Multipurpose Non-profit WordPress Theme for WordPress. It exists due to a missing capability check in the `alone_import_pack_install_plugin()` function in versions up to and including 7.8.3. This allows unauthenticated attackers to upload arbitrary files, including zip files containing webshells disguised as plugins, from remote locations. Successful exploitation of this vulnerability can lead to remote code execution, potentially giving attackers complete control over the affected website. It has been observed that attackers are exploiting this vulnerability to upload ZIP archives containing PHP-based backdoors, enabling them to execute remote commands, upload additional files, and create rogue administrator accounts.

Description: The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution.
Source: security@wordfence.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@wordfence.com: CWE-862

Hype score: Not currently trending

References