What the vulnerability does
01Description
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. CVE-2025-54019 is likely a duplicate of this.
Explanation of Vulnerability in Simple Terms
02Summary
The Alone – Charity Multipurpose Non-profit WordPress Theme through version 7.8.3 lacks proper authorization checks, allowing unauthenticated attackers to perform sensitive actions on affected sites. An attacker can read, modify, or delete data without needing to log in or interact with a user. This affects all installations of the theme up to and including version 7.8.3.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete site data without authentication.
Potential impact on your site
04Site Impact
Attackers can compromise your site's data, content, and functionality without any credentials.
Conditions required to exploit
05Prerequisites
Network access only; no login or user interaction required.
Key dates
06Disclosure timeline
July 15, 2025
CVE published
April 8, 2026
Record updated
