A severe security flaw in the popular WordPress theme ‘Alone’ is being actively exploited, allowing attackers to completely compromise websites. Security firm Wordfence reports blocking over 120,000 attack attempts targeting this vulnerability.
The flaw, identified as CVE-2025-5394, exists in all versions of the ‘Alone’ theme up to 7.8.3. It allows attackers without any login credentials to upload malicious files directly. The theme’s vendor, Bearsthemes, released a fix in version 7.8.5 on June 16, 2025.
The vulnerability stems from the theme’s alone_import_pack_install_plugin() function. This function, accessible to unauthenticated users via the wp_ajax_nopriv_ hook, lacks critical security checks (nonce verification). It accepts a remote URL in POST data, enabling attackers to trigger the installation of plugins from any location.
Attackers exploit this flaw to:
- Upload webshells hidden within ZIP archives.
- Deploy password-protected PHP backdoors enabling remote command execution.
- Create hidden administrator user accounts.
- Install file managers providing full control over site files and databases.
Notably, Wordfence observed attacks beginning several days before the vulnerability was publicly disclosed. This suggests threat actors monitored theme updates and patches to find exploitable flaws before website owners were alerted.
Signs a site using the ‘Alone’ theme may be compromised include:
- Unexpected new administrator users.
- Suspicious ZIP files or plugin folders.
- Requests to
admin-ajax.php?action=alone_import_pack_install_plugin.
Wordfence identified significant attack traffic originating from these IP addresses: 193.84.71.244, 87.120.92.24, 146.19.213.18, and 2a0b:4141:820:752::2. Administrators are advised to block these addresses immediately.
WordPress site owners using the ‘Alone’ theme must update to version 7.8.5 or later without delay. Sites running vulnerable versions are at immediate risk of complete takeover.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
