Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
97Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 49%
de la publicación al arma16 días
Publicada en NVD15 jul
1ª PoC+16d
VulnCheck+14d
probabilidad de explotación
49%top 1% de las CVE
explotación observada
síVulnCheck
7 exploit(s) público(s)
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. CVE-2025-54019 is likely a duplicate of this.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Bearsthemes · Alone – Charity Multipurpose Non-profit WordPress ThemePoCs públicas encontradas — 7
githubgithub.com/fokda-prodz/CVE-2025-5394★ 4githubgithub.com/Nxploited/CVE-2025-5394★ 3githubgithub.com/Yucaerin/CVE-2025-5394★ 1vulncheckvulncheck.com/xdb/79b473427d50no verificadovulncheckvulncheck.com/xdb/ef23f3f1907fno verificadovulncheckvulncheck.com/xdb/0764d90ddadcno verificadovulncheckvulncheck.com/xdb/4a55dc2578d5no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.