Alone Charity Multipurpose Non-Profit WordPress Theme Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability in the Alone – Charity Multipurpose Non-profit WordPress Theme, all versions through 7.8.3, allows for arbitrary file uploads. This issue arises from a missing capability check in the alone_import_pack_install_plugin() function. As a result, unauthenticated attackers can upload zip files containing web shells disguised as plugins, leading to remote code execution.

Impact

Exploitation of this vulnerability allows for arbitrary file uploads, which can be used to execute malicious code on the server.

Remediation

Users are advised to update to version 7.8.5 or a newer patched version.