Remote code execution vulnerability in WordPress Alone Theme is actively exploited
Take action: If you're using the WordPress "Alone" theme, immediately update to version 7.8.5 or higher, since websites with this theme are actively attacked. If you can't update right away, temporarily disable the Alone theme until you can apply the patch.
Learn More
Threat actors are actively exploiting a critical unauthenticated arbitrary file upload vulnerability in the WordPress theme "Alone," enabling remote code execution and complete website takeover
The flaw is tracked as CVE-2025-5394 (CVSS score 9.8) - and is caused by a design weakness in the theme's plugin installation functionality, within the alone_import_pack_install_plugin() function that handles plugin installations during theme setup procedures.
The vulnerable function lacks proper authorization checks and nonce verification mechanisms, making it accessible to any website visitor through the wp_ajax_nopriv_alone_import_pack_install_plugin AJAX action. This enables unauthenticated attackers to exploit the functionality by specifying both a plugin "slug" and a remote "source" parameter, allowing them to install malicious plugins from external servers without any authentication requirements.
Security researchers documented that attackers began exploiting this vulnerability on July 12, 2025, two days before the public disclosure of the flaw on July 14, 2025. This means that threat actors actively monitor software patches and changelogs to identify newly fixed security issues.
Wordfence security researchers have documented over 120,900 blocked exploitation attempts targeting this vulnerability since monitoring began, with attacks primarily originating from specific IP addresses including 193.84.71.244 (accounting for nearly 40,000 blocked requests), 87.120.92.24 (37,100+ requests), and 146.19.213.18,
Attackers are deploying malicious ZIP files with legitimate-sounding names such as "wp-classic-editor.zip" and "background-image-cropper.zip" to avoid detection by security monitoring systems. The malicious payloads include file managers that provide attackers with complete control over website databases, password-protected PHP backdoors enabling persistent remote command execution via HTTP requests, and scripts that create hidden administrator accounts for long-term access
The vulnerability impacts all versions of the Alone WordPress theme up to and including version 7.8.3.
The vendor, Bearsthemes, released a patched version 7.8.5 on June 16, 2025.
Website administrators must immediately update to Alone theme version 7.8.5 or later. Organizations unable to immediately implement the update should consider temporarily disabling the theme until the security patch can be applied.
