The flaw in Beplusthemes Alone results from improper control of code generation, allowing an attacker to inject and run arbitrary code on a WordPress site. An attacker who successfully exploits this weakness could execute malicious scripts, fully compromise the application, and potentially extend access to the underlying server or database. The weakness is classified as CWE-94: Improper Control of Generation of Code.

Any installation of the Alone theme from Beplusthemes that is running a version below 7.8.5 is affected. The vulnerability spans the entire theme component, meaning all sites using the theme without updating to the 7.8.5 release or later remain vulnerable.

The CVSS score of 6.5 indicates a moderate to high risk, but the EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The attack vector is not explicitly detailed in the description; based on the nature of code injection it is inferred that an attacker would need to supply unsanitized input to a theme hook via form submissions or query parameters. Although public exploitation is unlikely, a successful attack would lead to full compromise of the site and possibly the server.