The vulnerability arises from insufficient file path validation in the alone_import_pack_restore_data() function of the Alone – Charity Multipurpose Non‑profit WordPress Theme through version 7.8.5. The flaw allows any unauthenticated user to request deletion of arbitrary files on the web server. Deleting critical configuration files such as wp‑config.php can enable an attacker to execute scripts or seize full control of the site, thereby compromising confidentiality, integrity, and availability of the affected application. The weakness is classified as CWE‑73, indicating a lack of proper path sanitization. The CVSS score of 9.1 marks it as Critical severity.

Bearsthemes published the Alone – Charity Multipurpose Non‑profit WordPress Theme. All installations using versions 7.8.5 or earlier are vulnerable. Versions 7.8.6 and 7.8.7 contain the fix that validates file paths correctly and blocks unauthorized deletion attempts.

The EPSS score is below 1%, suggesting a small but non‑zero chance of exploitation in the wild at present. The absence of a KEV listing means there are no confirmed incidents yet reported in the CISA catalog, though the high CVSS indicates a strong potential impact. Attackers would simply need to construct a deletion request via the vulnerable function, which requires no authentication and can be triggered from any access point that calls alone_import_pack_restore_data().