Hackers Exploit Critical WordPress Theme Flaw to Hijack Sites via Remote Plugin Install

Threat actors are exploiting a critical vulnerability (CVE-2025-5394) in the “Alone – Charity Multipurpose Non-profit WordPress Theme,” which has a CVSS score of 9.8, allowing unauthorized file uploads and potential site takeovers. This flaw was discovered and reported by security researcher Thái An, raising significant security concerns for affected WordPress sites.

Want More Context? 🔎