**Cybercriminals are exploiting a severe security flaw in a popular WordPress charity theme, enabling complete website takeovers.**

## The Vulnerability

A critical security vulnerability (CVE-2025-5394) has been discovered in the “Alone – Charity Multipurpose Non-profit WordPress Theme,” earning a maximum severity score of 9.8 out of 10. Security researcher Thái An identified this dangerous flaw, which affects all theme versions up to 7.8.3.

The vulnerability stems from a flawed plugin installation function that lacks proper security checks. This oversight allows unauthorized users to upload malicious files and execute code remotely without any authentication – essentially giving attackers complete control over vulnerable websites.

## Active Exploitation Campaign

Threat actors began exploiting this vulnerability on July 12, 2025, just two days before it was publicly disclosed. This timing suggests cybercriminals were monitoring code repositories for newly patched vulnerabilities to exploit before users could update their systems.

Wordfence, a leading WordPress security company, has already blocked over 120,900 attack attempts targeting this flaw. The attacks originate from multiple IP addresses worldwide, indicating a coordinated campaign.

## Attack Methods

Cybercriminals are using this vulnerability to:
– Upload malicious ZIP files disguised as legitimate plugins
– Install PHP-based backdoors for remote command execution
– Deploy sophisticated file managers for persistent access
– Create unauthorized administrator accounts for long-term control

Common malicious files being uploaded include “wp-classic-editor.zip” and “background-image-cropper.zip,” which contain hidden backdoors.

## Protection Measures

WordPress site owners using this theme should immediately:

1. **Update to version 7.8.5** (released June 16, 2025) or later
2. **Audit administrator accounts** for any suspicious or unauthorized users
3. **Review server logs** for requests to “/wp-admin/admin-ajax.php?action=alone_import_pack_install_plugin”
4. **Conduct security scans** to detect any existing compromises

## Key Takeaway

This incident highlights the critical importance of prompt security updates and continuous monitoring. The rapid exploitation following the vulnerability’s discovery demonstrates how quickly cybercriminals can weaponize newly disclosed flaws, making immediate patching essential for website security.