Loading vulnerability…
CVE-2025-5394 is a critical vulnerability in the Alone – Charity Multipurpose Non-profit WordPress Theme for WordPress affecting all versions up to and including 7.8.3. The flaw is in the alone_import_pack_install_plugin() function, where a required authorization check is missing, allowing unauthenticated requests to invoke plugin installation functionality via AJAX. The vulnerable code path accepts a remote source and retrieves attacker-controlled ZIP archives that are treated as plugins. Because WordPress plugins can contain executable PHP code, an attacker can upload a malicious archive disguised as a plugin and obtain remote code execution on the target site. Reporting also references missing nonce verification, but the core security issue described is the absence of proper access control on a critical function exposed to unauthenticated users.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a single Python mass-exploitation script (exploiter.py) and a brief README referencing CVE-2025-5394 affecting the “Alone” WordPress theme (<= 7.8.3). The script performs unauthenticated exploitation over the network by POSTing to the WordPress AJAX endpoint /wp-admin/admin-ajax.php with action beplus_import_pack_install_plugin, instructing the target to download and install an attacker-hosted plugin ZIP (shell_url). It derives the plugin slug from the ZIP filename and then verifies success by requesting /wp-content/plugins/<slug>/<slug>.php. The tool supports multi-target scanning via a list file and concurrent exploitation using ThreadPoolExecutor (default 20 threads). Successful deployed shell URLs are logged to rce_results.txt. No additional modules, obfuscation, or framework integration are present; the payload itself is expected to be hosted externally as a ZIP containing a PHP webshell/plugin.
This repository targets CVE-2025-5394, a critical unauthenticated arbitrary file upload vulnerability in the WordPress Alone Theme (versions <= 7.8.3). The vulnerability allows remote attackers to upload and activate arbitrary plugin ZIP files via the unprotected AJAX endpoint '/wp-admin/admin-ajax.php?action=beplus_import_pack_install_plugin', leading to remote code execution (RCE). The repository contains two files: - README.md: Provides a detailed explanation of the vulnerability, exploitation steps, and usage instructions. It describes how an attacker can upload a malicious plugin (such as a PHP webshell) by sending a crafted POST request to the vulnerable AJAX endpoint, resulting in full site compromise. - mass_beplus_exploit.py: A Python script that automates mass exploitation. It reads a list of target sites from 'target.txt', sends the exploit POST request to each, and logs successful compromises to 'result.txt'. The script is multi-threaded for efficiency and expects the malicious plugin ZIP to be hosted at a specified remote URL (default: 'https://yourweb.com/hello-dolly.zip'). The exploit's main capability is to achieve unauthenticated remote code execution on vulnerable WordPress sites by installing and activating a backdoored plugin. The endpoints involved include the vulnerable AJAX handler, the remote plugin ZIP URL, and the deployed webshell path. The repository is operational and ready for use in mass exploitation scenarios.
This repository contains a Python exploit script (CVE-2025-5394.py) targeting CVE-2025-5394, a critical unauthenticated arbitrary plugin upload vulnerability in the Alone WordPress theme (versions <= 7.8.3). The exploit abuses a missing capability check in the 'alone_import_pack_install_plugin' AJAX action, allowing an attacker to upload a ZIP file containing a malicious plugin (webshell) from a remote URL. The script requires the attacker to provide the target WordPress site URL and the URL to a ZIP file with a valid plugin structure and a PHP webshell. Upon execution, the script sends a crafted POST request to the /wp-admin/admin-ajax.php endpoint, triggering the vulnerable action. If successful, the webshell is accessible at /wp-content/plugins/{plugin_slug}/{plugin_slug}.php, granting remote code execution. The repository includes a README with detailed usage instructions, webshell requirements, and example output. The exploit is operational, requiring a prepared payload but automating the exploitation process. No detection or scanning functionality is present; the script is solely for exploitation.
This repository contains an exploit for CVE-2025-5394, targeting the WP Alone WordPress theme (version 7.8.3 and below). The exploit consists of a Python script ('exploit.py') that automates the process of creating a malicious WordPress plugin (containing a PHP web shell), uploading it to the target site via a vulnerable AJAX action, and testing the shell for successful command execution. The repository also includes a brief README. The main exploit file is 'exploit.py', which handles ZIP creation, file upload, and shell testing. The exploit leverages a network-based attack vector, requiring access to the target's WordPress admin AJAX endpoint. If successful, it provides the attacker with a persistent web shell for arbitrary command execution.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An arbitrary plugin installation to remote code execution vulnerability in the Alone WordPress Theme used to install attacker-hosted ZIP payloads.
An arbitrary file upload vulnerability in the Alone WordPress theme that attackers used in a separate campaign to deploy malicious archives masquerading as background-image-cropper.
A remote code execution vulnerability in the WordPress Alone theme mentioned as threat landscape context and comparison.
Critical WordPress theme ('Alone – Charity Multipurpose Non-profit') arbitrary file upload flaw actively exploited to hijack sites via remote plugin install/takeover.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.