CVE-2025-60206
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2Tags
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through <= 7.8.3.
Analysis
Remote code execution in Beplusthemes Alone WordPress theme through version 7.8.3 allows unauthenticated attackers to inject and execute arbitrary code via a code injection vulnerability. With a critical CVSS score of 10.0 and network-based exploitation requiring no privileges or user interaction, this vulnerability enables complete system compromise. EPSS exploitation probability is low (0.06%, 17th percentile), and no public exploit or CISA KEV listing identified at time of analysis.
Technical Context
This vulnerability stems from improper control of code generation (CWE-94), a critical weakness where user-controllable input is incorporated into executable code without proper validation or sanitization. WordPress themes often use dynamic code evaluation functions (eval, create_function, or similar constructs) for template processing or configuration handling. When user-supplied data flows into these mechanisms without sanitization, attackers can inject arbitrary PHP code that executes with the web server's privileges. The vulnerability exists in the Alone theme, a commercial WordPress theme by Beplusthemes, affecting all versions through 7.8.3. The network attack vector suggests the injection point is accessible via HTTP requests, potentially through theme customization endpoints, AJAX handlers, or shortcode processing that fails to validate input before passing it to code execution functions.
Affected Products
The vulnerability affects Beplusthemes Alone WordPress theme versions through 7.8.3, with the initial affected version not specified in available data. This is a commercial WordPress theme product, meaning affected installations are limited to customers who purchased and deployed this specific theme. The Patchstack database entry confirms the vulnerability scope encompasses all versions up to and including 7.8.3. Organizations should inventory WordPress installations to identify sites using the Alone theme and cross-reference deployed versions against the vulnerable range.
Remediation
Immediately upgrade the Beplusthemes Alone theme to version 7.8.4 or later if available from the vendor. Consult the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Theme/alone/vulnerability/wordpress-alone-theme-7-8-3-remote-code-execution-rce-vulnerability for the latest remediation guidance and confirmed patched versions. If an updated theme version is not available, consider temporarily disabling the Alone theme and switching to a secure alternative WordPress theme until a vendor patch is released. Implement web application firewall (WAF) rules to block suspicious POST/GET parameters targeting known WordPress theme endpoints. Review web server logs for evidence of exploitation attempts, focusing on requests containing PHP code patterns, eval statements, or system command strings directed at theme files. For environments requiring continued use of vulnerable versions, restrict administrative access and implement strict input validation at the web server or reverse proxy layer.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today