Article Details
Scrape Timestamp (UTC): 2025-07-31 06:57:01.647
Source: https://thehackernews.com/2025/07/hackers-exploit-critical-wordpress.html
Original Article Text
Click to Toggle View
Hackers Exploit Critical WordPress Theme Flaw to Hijack Sites via Remote Plugin Install. Threat actors are actively exploiting a critical security flaw in "Alone – Charity Multipurpose Non-profit WordPress Theme" to take over susceptible sites. The vulnerability, tracked as CVE-2025-5394, carries a CVSS score of 9.8. Security researcher Thái An has been credited with discovering and reporting the bug. According to Wordfence, the shortcoming relates to an arbitrary file upload affecting all versions of the plugin prior to and including 7.8.3. It has been addressed in version 7.8.5 released on June 16, 2025. CVE-2025-5394 is rooted in a plugin installation function named "alone_import_pack_install_plugin()" and stems from a missing capability check, thereby allowing unauthenticated users to deploy arbitrary plugins from remote sources via AJAX and achieve code execution. "This vulnerability makes it possible for an unauthenticated attacker to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover," Wordfence's István Márton said. Evidence shows that CVE-2025-5394 began to be exploited starting July 12, two days before the vulnerability was publicly disclosed. This indicates that the threat actors behind the campaign may have been actively monitoring code changes for any newly addressed vulnerabilities. The company said it has already blocked 120,900 exploit attempts targeting the flaw. The activity has originated from the following IP addresses - In the observed attacks, the flaw is averaged to upload a ZIP archive ("wp-classic-editor.zip" or "background-image-cropper.zip") containing a PHP-based backdoor to execute remote commands and upload additional files. Also delivered are fully-featured file managers and backdoors capable of creating rogue administrator accounts. To mitigate any potential threats, WordPress site owners using the theme are advised to apply the latest updates, check for any suspicious admin users, and scan logs for the request "/wp-admin/admin-ajax.php?action=alone_import_pack_install_plugin."
Daily Brief Summary
A critical vulnerability in the "Alone – Charity Multipurpose Non-profit WordPress Theme" identified as CVE-2025-5394, enables hackers to remotely install plugins and execute code.
Security researcher Thái An discovered the flaw, which affects all theme versions up to 7.8.3.
The exploit allows unauthorized users to upload arbitrary files through AJAX, achieving remote code execution for full site control.
Attackers exploited the vulnerability starting July 12, 2025, two days prior to its public disclosure, suggesting pre-emptive monitoring by cybercriminals.
Wordfence has recorded over 120,900 attempts to exploit this vulnerability, primarily using backdoors and rogue admin accounts.
To safeguard against attacks, WordPress site owners should update to the latest theme version, monitor for unusual admin activity, and review relevant server logs.
Common files uploaded during these attacks include "wp-classic-editor.zip" and "background-image-cropper.zip," which contain malicious PHP scripts.