Arbitrary File Deletion in Alone Charity Non-profit Theme for WordPress

CVE-2025-5393

What is CVE-2025-5393?

The Alone – Charity Multipurpose Non-profit WordPress Theme exposes a significant vulnerability allowing arbitrary file deletion due to inadequate validation of file paths in the alone_import_pack_restore_data() function. This flaw affects all versions up to 7.8.3 and enables unauthorized users to delete critical files from the server. Such deletions can trigger severe security issues, including the potential for remote code execution, particularly if sensitive files like wp-config.php are targeted.

References