Arbitrary File Upload Vulnerability in Alone Charity Theme for WordPress
CVE-2025-5394

9.8CRITICAL

Key Information:

Vendor: WordPress
Status: Alone – Charity Multipurpose Non-profit WordPress Theme
Vendor: CVE Published:; 15 July 2025

Badges

🥇 Trended No. 1📈 Trended📈 Score: 2,660💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 21%📰 News Worthy

What is CVE-2025-5394?

CVE-2025-5394 is a significant vulnerability affecting the Alone Charity Multipurpose Non-profit WordPress Theme, designed for creating and managing charity-related websites. This vulnerability arises due to inadequate capability checks within the alone_import_pack_install_plugin() function, present in all versions of the theme up to and including 7.8.3. As a result, unauthenticated attackers can exploit this flaw to upload malicious zip files containing webshells disguised as plugins, leading to remote code execution on the server. This could seriously compromise the confidentiality, integrity, and availability of the affected organization's web assets, allowing attackers to gain unauthorized access and potentially control over sensitive data and functionalities.

Potential impact of CVE-2025-5394

Remote Code Execution: The vulnerability enables attackers to run arbitrary code on the server, which could lead to full system compromise, allowing them to manipulate website content, exfiltrate sensitive information, or deploy further malicious payloads.
Data Breaches: By exploiting this vulnerability, unauthorized users may gain access to sensitive data stored within the website, including donor information, financial records, and other confidential content, leading to significant privacy violations and potential legal ramifications.
Website Defacement and Downtime: Successful exploitation could result in website defacement or complete site shutdown. This not only damages the organization’s reputation but also disrupts service availability to users, impacting fundraising and community engagement efforts critical to non-profit operations.

Affected Version(s)

Alone – Charity Multipurpose Non-profit WordPress Theme * <= 7.8.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-5394
Created by Yucaerin

News Articles

Cyber Security Agency of Singapore

CVE-2025-5394

Critical Vulnerability in WordPress Theme

Bearsthemes has released a patch addressing a critical vulnerability in a WordPress Theme, Alone. Users and administrators of affected products are advised...

3 weeks ago