What is the CVSS score of CVE-2025-60206?

CVE-2025-60206 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-60206?

CVE-2025-60206 is a critical remote code execution vulnerability affecting Beplusthemes Alone WordPress theme up to version 7.8.3 that allows unauthenticated attackers to execute arbitrary code and…

How to fix or mitigate CVE-2025-60206?

Within 24 hours: Audit all WordPress installations for Beplusthemes Alone theme and identify current versions in use. Within 7 days: If using version 7.8.3 or earlier with no patch available, disable or remove the theme immediately and replace with an alternative WordPress theme; if the theme is active, switch to a hardened theme and perform full site forensics. Within 30 days: Once vendor releases a patched version, upgrade all WordPress installations to the fixed theme version and conduct comprehensive security assessment for signs of prior exploitation.

PHP CVE-2025-60206

CRITICAL

Code Injection (CWE-94)

2025-10-22 audit@patchstack.com

WordPress PHP Code Injection

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

CRITICAL 10.0

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through <= 7.8.3.

AnalysisAI

Remote code execution in Beplusthemes Alone WordPress theme through version 7.8.3 allows unauthenticated attackers to inject and execute arbitrary code via a code injection vulnerability. With a critical CVSS score of 10.0 and network-based exploitation requiring no privileges or user interaction, this vulnerability enables complete system compromise. EPSS exploitation probability is low (0.06%, 17th percentile), and no public exploit or CISA KEV listing identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper control of code generation (CWE-94), a critical weakness where user-controllable input is incorporated into executable code without proper validation or sanitization. WordPress themes often use dynamic code evaluation functions (eval, create_function, or similar constructs) for template processing or configuration handling. When user-supplied data flows into these mechanisms without sanitization, attackers can inject arbitrary PHP code that executes with the web server's privileges. The vulnerability exists in the Alone theme, a commercial WordPress theme by Beplusthemes, affecting all versions through 7.8.3. The network attack vector suggests the injection point is accessible via HTTP requests, potentially through theme customization endpoints, AJAX handlers, or shortcode processing that fails to validate input before passing it to code execution functions.

Affected ProductsAI

The vulnerability affects Beplusthemes Alone WordPress theme versions through 7.8.3, with the initial affected version not specified in available data. This is a commercial WordPress theme product, meaning affected installations are limited to customers who purchased and deployed this specific theme. The Patchstack database entry confirms the vulnerability scope encompasses all versions up to and including 7.8.3. Organizations should inventory WordPress installations to identify sites using the Alone theme and cross-reference deployed versions against the vulnerable range.

RemediationAI

Immediately upgrade the Beplusthemes Alone theme to version 7.8.4 or later if available from the vendor. Consult the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Theme/alone/vulnerability/wordpress-alone-theme-7-8-3-remote-code-execution-rce-vulnerability for the latest remediation guidance and confirmed patched versions. If an updated theme version is not available, consider temporarily disabling the Alone theme and switching to a secure alternative WordPress theme until a vendor patch is released. Implement web application firewall (WAF) rules to block suspicious POST/GET parameters targeting known WordPress theme endpoints. Review web server logs for evidence of exploitation attempts, focusing on requests containing PHP code patterns, eval statements, or system command strings directed at theme files. For environments requiring continued use of vulnerable versions, restrict administrative access and implement strict input validation at the web server or reverse proxy layer.