CVE-2025-54019 MEDIUM

CVE-2025-54019: WordPress Alone < 7.8.5 - Arbitrary Code Execution Vulnerability

Vendor Beplusthemes

Product Alone

Weakness CWE-94 · Code injection

Published August 20, 2025

Last update May 13, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through < 7.8.5.

Explanation of Vulnerability in Simple Terms

02Summary

Beplusthemes Alone versions up to 7.8.5 contain a code injection vulnerability that allows attackers to inject and execute arbitrary code. The vulnerability requires specific conditions to exploit but can affect confidentiality, integrity, and availability. Site administrators should update to a version newer than 7.8.5 as soon as possible.

What an attacker can do

03Attacker Capabilities

Inject and execute arbitrary code on the site under specific conditions.

Potential impact on your site

04Site Impact

Attackers could read sensitive data, modify site content, or disrupt site availability if they successfully exploit the injection flaw.

Conditions required to exploit

05Prerequisites

Network access; no authentication required, but attack complexity is high.

Key dates

06Disclosure timeline

August 20, 2025 CVE published

May 13, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-54019 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html

Related vulnerabilities