The vulnerability arises from insufficient file path validation in the alone_import_pack_restore_data() function of the Alone – Charity Multipurpose Non‑profit WordPress Theme through version 7.8.5. The flaw allows arbitrary files on the web server. Deleting critical configuration files such as wp‑config.php can enable an attacker to execute scripts or seize full control of the site, thereby compromising confidentiality, integrity, and availability of the affected application. The weakness is classified as CWE‑73, indicating a lack of proper path sanitization. The CVSS score of 9.1 marks it as Critical severity.

Bearsthemes published the Alone – Charity Multipurpose Non‑profit WordPress Theme. All installations using versions 7.8.5 or earlier are vulnerable. The fix that validates file paths correctly and blocks unauthorized deletion attempts is fully addressed in version 7.8.7; the status of versions such as 7.8.6 has not been explicitly documented and is therefore unknown.

The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The absence of a KEV listing means there are no confirmed incidents yet reported in the CISA catalog, though the high CVSS indicates a strong potential impact. Attackers would construct a deletion request via the vulnerable function, which requires no authentication and can be triggered from any access point that calls alone_import_pack_restore_data().