CVE-2025-5394

What it actually does

Missing authorization check on alone_import_pack_install_plugin() permits unauthenticated remote upload of arbitrary zip archives that are installed as plugins, resulting in immediate code execution on the web server.

Why it matters to the business

Attackers can fully compromise any site running the vulnerable theme, leading to website defacement, data theft, malware distribution, or use as a launch point for further network attacks; the weaponized exploit and rising EPSS increase urgency for public-facing sites.

How an attack unfolds

An attacker sends an unauthenticated HTTP request directly to the theme's alone_import_pack_install_plugin endpoint, supplying a remote URL to a crafted zip containing a webshell disguised as a plugin; the missing capability check allows the file to be downloaded, extracted, and activated, granting persistent remote code execution.

How to fix it

Immediately update the Alone theme to a version newer than 7.8.3; if an update is unavailable, remove or rename the alone_import_pack_install_plugin function and restrict plugin installation to authenticated administrators only.

How to confirm the fix worked

Confirm the theme version is greater than 7.8.3 via the WordPress admin dashboard or filesystem; test that unauthenticated requests to the import function now return authorization errors; monitor plugin upload logs for unexpected activity.

Typical attack path

1. Discover WordPress site using Alone theme version <= 7.8.3
2. Locate the unauthenticated alone_import_pack_install_plugin AJAX or REST endpoint
3. Craft and host a malicious plugin zip containing a webshell
4. Issue POST request supplying the remote zip URL
5. Trigger plugin activation to execute arbitrary PHP code
6. Establish persistence or pivot within the environment

How to detect it

Review web server and WordPress debug logs for POST requests to alone_import_pack_install_plugin or import-pack endpoints from unauthenticated sources; inspect wp-content/plugins and uploads directories for recently added zip or PHP files whose names do not match known legitimate plugins; correlate with file-creation timestamps around the time of suspicious requests.

• alone_import_pack_install_plugin
• import_pack_install_plugin
• wp-content/plugins/.*\.zip
• POST /wp-admin/admin-ajax.php.*action=alone_import_pack

What your security team should do

• Prioritize patching all instances of the Alone theme within 48 hours given weaponized exploit maturity
• Temporarily disable the vulnerable function via code edit or WAF rule if update cannot be applied immediately
• Scan WordPress installations for unexpected plugin files or webshells in wp-content/plugins
• Enable logging of all AJAX and REST requests to the theme's import functions