Warning: A critical vulnerability in the Alone-Charity Multipurpose Non-profit WordPress Theme is currently being actively exploited. Patch Immediately!

CVE-2025-5394 is a critical (CVSS 9.8) arbitrary file upload vulnerability in the Alone – Charity Multipurpose Non-profit WordPress Theme (<=7.8.3) that allows unauthenticated attackers to upload plugin-like ZIPs containing web shells via an AJAX action, enabling remote code execution and site takeover; it has been actively exploited since 12 July 2025 with Wordfence observing over 120,900 exploitation attempts. The Centre for Cybersecurity Belgium and Wordfence recommend urgent patching to version 7.8.5 or later, enhanced monitoring/detection, and investigation/remediation of historic compromises using published IOCs.