{"uuid": "0228e8de-c4b6-444e-b52e-9a5fa52d4a03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-5394", "type": "seen", "source": "https://t.me/pphm_HackerNews/745", "content": "Popular Website Theme Leaves Thousands Open to Silent Takeovers\n\nA severe security flaw (CVE-2025-5394, CVSS 9.8) has been detected in the Alone \u2013 Charity Multipurpose WordPress Theme, allowing unauthenticated attackers to upload arbitrary files via AJAX and execute remote code. The issue stems from the alone_import_pack_install_plugin() function, which lacks proper capability checks and enables unauthorized plugin installation from remote sources.\n\n\ud83d\udd17 Read More", "creation_timestamp": "2026-07-23T00:00:24.478693Z"}