The Alone – Charity Multipurpose Non‑profit WordPress Theme allows an unauthenticated user to upload ZIP archives because the function alone_import_pack_install_plugin() lacks a capability check. If the attacker places a malicious file such as a webshell inside the archive, the theme will extract it during the import, and the code will run on the server, giving the attacker full remote code execution.

All releases of the Bearsthemes Alone – Charity Multipurpose Non‑profit WordPress Theme up to and including version 7.8.3 are vulnerable. Sites that continue using the theme and have not removed the import feature or updated the theme remain at risk.

With a CVSS score of 9.8 and an EPSS score of 52%, this vulnerability is critical and likely to be exploited in the wild. It is not yet listed in the CISA KEV catalog. The attack vector is network‑based: an unauthenticated attacker can reach the theme’s upload endpoint and supply a crafted ZIP file. The missing authorization check corresponds to CWE‑862, allowing unauthenticated arbitrary file uploads that lead to remote code execution.