Please note Office visits are by appointment only. We support businesses with 10+ users or workstations, or with servers or cloud services to manage. No residential or walk-in computer repair. Book a time →

Hackers Exploit Critical WordPress Theme Flaw to Hijack Sites via Remote Plugin Install

Written by

Robert Timlick

in

Threat actors are actively exploiting a critical security flaw in “Alone – Charity Multipurpose Non-profit WordPress Theme” to take over susceptible sites.
The vulnerability, tracked as CVE-2025-5394, carries a CVSS score of 9.8. Security researcher Thái An has been credited with discovering and reporting the bug.
According to Wordfence, the shortcoming relates to an arbitrary file upload

More posts