The vulnerable Alone – Charity Multipurpose Non‑profit WordPress Theme allows arbitrary file uploads because the alone_import_pack_install_plugin() function lacks a capability check. Attackers who are not authenticated can upload ZIP archives that contain malicious code such as webshells. When the archive is processed by the theme, the malicious payload can be executed on the server, giving remote code execution across the affected site.

All releases of the Bearsthemes Alone – Charity Multipurpose Non‑profit WordPress Theme with version numbers up to and including 7.8.3 are affected. The issue remains in any build that has not yet been updated by the vendor.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of 17% suggests a moderate probability of exploitation in the wild. Because the vulnerability can be triggered by an unauthenticated remote attacker who can upload arbitrary files, the attack vector is network‑based and requires only the ability to reach the site’s upload endpoint. The lack of authorization checks aligns with CWE‑862. Although it is not currently listed in the CISA KEV catalog, the high severity and the availability of webshell payloads make it a serious risk for any site still running a vulnerable theme.