Description
WordPress 主题 Alone – Charity Multipurpose Non-profit 在 7.8.3 及之前版本中，alone_import_pack_install_plugin() 函数缺少必要的权限校验，导致存在任意文件上传漏洞，未认证的攻击者可从远程位置上传包含 WebShell 的 ZIP 插件文件并进行安装，从而实现远程代码执行。
WordPress Plugin Alone Theme /wp-admin/admin-ajax.php beplus_import_pack_install_plugin 文件上传漏洞（CVE-2025-5394）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-5394
https://www.wordfence.com/blog/2025/07/attackers-actively-exploiting-critical-vulnerability-in-alone-theme/
https://themeforest.net/item/alone-charity-multipurpose-nonprofit-wordpress-theme/15019939
https://hivepro.com/threat-advisory/alone-theme-vulnerability-puts-wordpress-sites-at-risk/
https://securityaffairs.com/180630/hacking/attackers-actively-exploit-critical-zero-day-in-alone-wordpress-theme.html
https://cve.imfht.com/poc_detail/81e7fc5ab68936da8e3cd6cbad24c3837188fcf0?lang=en
https://ccb.belgium.be/advisories/warning-critical-vulnerability-alone-charity-multipurpose-non-profit-wordpress-theme
https://fidelissecurity.com/vulnerabilities/cve-2025-5394/
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-076/
https://access.redhat.com/security/cve/cve-2025-5394