146[.]19[.]213[.]18

Threat actors are actively exploiting a critical security flaw in "Alone – Charity Multipurpose Non-profit WordPress Theme" to take over susceptible sites. The vulnerability, tracked as CVE-2025-5394, carries a CVSS score of 9.8. Security researcher Thái An has been credited with discovering and reporting the bug. According to Wordfence, the shortcoming relates to an arbitrary file upload affecting all versions of the plugin prior to and including 7.8.3. It has been addressed in version 7.8.5 released on June 16, 2025. CVE-2025-5394 is rooted in a plugin installation function named "alone_import_pack_install_plugin()" and stems from a missing capability check, thereby allowing unauthenticated users to deploy arbitrary plugins from remote sources via AJAX and achieve code execution. "This vulnerability makes it possible for an unauthenticated attacker to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover," Wordfence's István Márton said. Evidence shows that CVE-2025-5394 began to be exploited starting July 12, two days before the vulnerability was publicly disclosed. This indicates that the threat actors behind the campaign may have been actively monitoring code changes for any newly addressed vulnerabilities. The company said it has already blocked 120,900 exploit attempts targeting the flaw. The activity has originated from the following IP addresses - 193.84.71.244 87.120.92.24 146.19.213.18 185.159.158.108 188.215.235.94 146.70.10.25 74.118.126.111 62.133.47.18 198.145.157.102 2a0b:4141:820:752::2 In the observed attacks, the flaw is averaged to upload a ZIP archive ("wp-classic-editor.zip" or "background-image-cropper.zip") containing a PHP-based backdoor to execute remote commands and upload additional files. Also delivered are fully-featured file managers and backdoors capable of creating rogue administrator accounts. To mitigate any potential threats, WordPress site owners using the theme are advised to apply the latest updates, check for any suspicious admin users, and scan logs for the request "/wp-admin/admin-ajax.php?action=alone_import_pack_install_plugin."

Threat actors are actively exploiting a critical unauthenticated arbitrary file upload vulnerability in the WordPress theme 'Alone,' to achieve remote code execution and perform a full site takeover. Wordfence is reporting the malicious activity, saying it has blocked over 120,000 exploitation attempts targeting its customers. The WordPress security firm also reports that the attacks started several days before public disclosure of the flaw, indicating that threat actors are monitoring changelogs and patches to discover trivially exploitable issues before alerts are sent to website owners. The vulnerability, tracked under CVE-2025-5394, impacts all versions of Alone up to 7.8.3. The vendor, Bearsthemes, fixed it in Alone version 7.8.5, released on June 16, 2025. The problem stems from the theme's 'alone_import_pack_install_plugin()' function, which lacks nonce checks and is exposed via the wp_ajax_nopriv_ hook. The function allows plugin installation via AJAX, and accepts a remote source URL in the POST data, enabling unauthenticated users to trigger plugin installations from remote URLs. According to Wordfence, attackers leverage the flaw to upload webshells inside ZIP archives, deploy password-protected PHP backdoors that allow persistent remote command execution via HTTP requests, or create hidden administrator users. In some cases, the attackers even install full-featured file managers that give them complete control over the site's databases. Given the above, signs of compromise include the appearance of new admin users, suspicious ZIP/plugin folders, and requests to 'admin-ajax.php?action=alone_import_pack_install_plugin.' Wordfence logged tens of thousands of exploitation attempts from the IP addresses 193.84.71.244, 87.120.92.24, 146.19.213.18, and 2a0b:4141:820:752::2, so these should be blocked immediately. Alone is a premium theme with nearly 10,000 sales on the Envato market, primarily used by non-profits such as charities, NGOs, fundraising organizations, and social organizations. Although Wordfence submitted a report to Bearsthemes as early as May 30, 2025, they did not hear back, so they escalated the issue to the Envato team on June 12. Four days later, the vendor released a fixed version of Alone, v7.8.5, which is the recommended update target for all users. Last month, another premium WordPress theme, Motors, was targeted by hackers who exploited a user validation flaw to hijack administrator accounts on vulnerable websites. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report