WordPress Alone Theme Vulnerability: Hackers Seize Control Via Remote Plugin Installs
- John Jordan
- 1 day ago
- 1 min read
Hackers are actively exploiting a critical vulnerability in the WordPress "Alone" theme, allowing them to gain full control of websites. The flaw, identified as CVE-2025-5394, enables unauthenticated attackers to install malicious plugins remotely, leading to widespread site takeovers. Security firms have reported a surge in exploitation attempts, highlighting the urgency for users to update their themes.
Sources
Hackers actively exploit critical RCE in WordPress Alone theme, BleepingComputer.
WordPress Theme RCE Vulnerability Actively Exploited to Take Full Site Control, CyberSecurityNews.
WordPress Theme Security Vulnerability Enables to Execute Arbitrary Code Remotely, GBHackers News.
WordPress Bricks Theme Under Active Attack: Critical Flaw Impacts 25,000+ Sites, The Hacker News.