Alone Theme CVE-2025-5394: Unauthenticated File Upload to RCE, Actively Exploited (CVSS 9.8)

In July 2025, attackers began quietly hijacking WordPress sites through a premium theme called Alone – Charity Multipurpose Non-profit WordPress Theme. The flaw they abused, tracked as CVE-2025-5394, carries a near-maximum severity score of 9.8 out of 10 and lets a completely unauthenticated visitor upload a malicious file and run their own code on your server. In practice, that means a full site takeover — no password, no login, and no user account required.

What makes this vulnerability especially urgent is that it was exploited as a zero-day. Wordfence, the security firm that received the report, observed attacks beginning on July 12, 2025 — two days before the vulnerability was publicly disclosed on July 14. If you run the Alone theme, or you have inherited a site that does, this is one to act on immediately. Below we break down what the flaw is, how it works, and exactly what to do about it.

CVE-2025-5394 at a glance

The vulnerability was reported to Wordfence on May 30, 2025 by security researcher Thái An, and the theme’s developer released a fix in version 7.8.5. Because the flaw lets an unauthenticated attacker reach remote code execution, it falls into the most dangerous category of WordPress vulnerabilities there is.

How the vulnerability works

The Alone theme ships with a “demo import” feature that can install companion plugins for you during setup. Behind the scenes, that convenience is powered by a function named alone_import_pack_install_plugin(), which is wired into WordPress’s AJAX system.

Here is the problem. The function was registered through the wp_ajax_nopriv_ hook — the WordPress mechanism for exposing an action to logged-out visitors. On its own that is not unusual, but the function was missing two critical safeguards:

• A capability check to confirm the request came from a user actually allowed to install plugins (normally an administrator).
• A nonce check to confirm the request genuinely originated from your own site rather than a forged, external one.

Because both checks were absent, anyone on the internet could call the endpoint and tell it to install a “plugin” — and crucially, the plugin source could be a remote URL that the attacker controls. The attacker simply points the function at a ZIP file hosted on their own server. WordPress dutifully downloads it, unpacks it into wp-content/plugins/, and the PHP code inside becomes live and executable on your site. Hide a web shell inside that ZIP and the attacker gains hands-on control of the server. In short, the only thing an attacker needs is your site’s address.

Real-world impact

This is not a theoretical risk. In the weeks around disclosure, Wordfence blocked more than 120,900 exploit attempts targeting the Alone theme. A handful of aggressive IP addresses — including 193.84.71.244 and 87.120.92.24 — were each responsible for tens of thousands of malicious requests.

In the observed attacks, criminals uploaded ZIP files with innocent-sounding names such as wp-classic-editor.zip that actually contained PHP backdoors. Once installed, those backdoors let attackers:

• Run arbitrary commands on the server.
• Upload additional malware and full-featured file managers.
• Create hidden administrator accounts to keep access even after the theme is patched.

From there the possibilities are the usual nightmare list: stealing customer and user data, injecting spam or malicious redirects, defacing pages, harvesting other credentials from the server, or quietly enrolling the site into a botnet. Because the attacker gains code execution rather than just database access, recovering a compromised site usually means a full clean-up and rebuild — not a simple password reset.

How to check if you’re affected

• Confirm the theme. In your dashboard, go to Appearance → Themes. If “Alone” is present — whether active or just installed — you may be exposed.
• Check the version. Open the theme’s details, or read the Version: line in its style.css file. Anything 7.8.3 or older is vulnerable.
• Search your logs. Look through your web server access logs for requests to /wp-admin/admin-ajax.php that contain action=alone_import_pack_install_plugin. Those are exploitation attempts.
• Look for signs of compromise. Watch for administrator accounts you never created, plugins you never installed (for example one called “wp-classic-editor”), or unfamiliar PHP files inside wp-content/plugins/.

How to fix it

Update the Alone theme to version 7.8.5 or later right now. This is the single most important step: it closes the hole by adding the authorization checks that were missing. From the dashboard, go to Appearance → Themes or Dashboard → Updates and apply the update.

If you cannot update immediately, take the site offline or place it behind a web application firewall (WAF) that blocks the malicious requests until you can patch. Then, because this flaw has been exploited in the wild, treat any un-updated, internet-facing site as potentially compromised and work through an incident-response checklist:

• Scan the site with a reputable malware scanner, and review every administrator account, removing any you do not recognize.
• Inspect wp-content/plugins/ for plugins you did not install and delete any unknown PHP files.
• Rotate all passwords and regenerate your secret keys and salts in wp-config.php to invalidate any stolen sessions.
• Review scheduled tasks (WP-Cron) and the database for injected content or rogue entries.
• If you find a backdoor, assume the entire site is dirty: restore from a known-good backup taken before July 12, 2025, or rebuild from clean core, theme, and plugin files.

The takeaway

CVE-2025-5394 is a textbook illustration of two lessons every WordPress owner should take to heart. First, premium and niche themes need updating just as urgently as popular plugins — attackers do not care how “small” a product is when the flaw is this severe. Second, attackers actively monitor patch releases and changesets, reverse-engineering fixes to strike sites that have not updated yet. That is exactly why this vulnerability was already being exploited before it was even public.

The gap between “a patch exists” and “you installed it” is the most dangerous window in your site’s life. Keep your themes and plugins current, remove the ones you do not use, put a firewall in front of your site, follow the principle of least privilege for user accounts, and keep tested backups. None of it is glamorous, but that ordinary hygiene is what turns a critical, actively-exploited vulnerability like this one into a non-event for your site.