Cybercriminals are actively exploiting a severe security flaw in the popular WordPress theme “Alone,” enabling them to completely take over websites through unauthorized file uploads and remote code execution.
## The Threat Landscape
Security firm Wordfence has reported blocking over 120,000 exploitation attempts targeting this vulnerability, designated as CVE-2025-5394. The attacks began several days before the flaw was publicly disclosed, suggesting threat actors are monitoring software updates and patches to identify vulnerabilities before website owners receive security alerts.
## Vulnerability Details
The critical flaw affects all versions of the Alone theme up to 7.8.3. The vulnerability stems from a function called ‘alone_import_pack_install_plugin()’ that lacks proper security checks and allows unauthenticated users to install plugins remotely via AJAX requests.
**Key technical issues:**
– Missing nonce verification
– Exposed through wp_ajax_nopriv_ hook
– Accepts remote URL sources in POST data
– Enables unauthorized plugin installations
## Attack Methods
Cybercriminals are leveraging this vulnerability to:
– Upload malicious webshells hidden in ZIP archives
– Deploy password-protected PHP backdoors for persistent access
– Create hidden administrator accounts
– Install comprehensive file managers for complete site control
– Access and manipulate website databases
## Signs of Compromise
Website owners should watch for these indicators:
– Unexpected new administrator accounts
– Suspicious ZIP files or plugin folders
– Unusual requests to ‘admin-ajax.php?action=alone_import_pack_install_plugin’
## Threat Actor Activity
Wordfence has identified several IP addresses responsible for tens of thousands of attack attempts:
– 193.84.71.244
– 87.120.92.24
– 146.19.213.18
– 2a0b:4141:820:752::2
These addresses should be immediately blocked by affected organizations.
## Impact and Target Profile
The Alone theme is a premium WordPress theme with nearly 10,000 sales on the Envato marketplace. It’s primarily used by:
– Non-profit organizations
– Charities and NGOs
– Fundraising organizations
– Social advocacy groups
## Timeline and Response
– **May 30, 2025**: Wordfence reported the vulnerability to Bearsthemes
– **June 12, 2025**: Issue escalated to Envato team due to lack of vendor response
– **June 16, 2025**: Bearsthemes released fixed version 7.8.5
## Immediate Action Required
All users of the Alone WordPress theme must immediately update to version 7.8.5 or later. This update addresses the critical vulnerability and prevents unauthorized access attempts.
## Broader Context
This incident follows a similar attack last month targeting the Motors WordPress theme, where hackers exploited user validation flaws to hijack administrator accounts. These incidents highlight the ongoing threat to premium WordPress themes and the importance of rapid security updates.
Website administrators using premium WordPress themes should implement regular update schedules and monitor for suspicious activity to protect against similar vulnerabilities.