HACKERS ACTIVELY EXPLOIT CRITICAL RCE IN WORDPRESS ALONE THEME

Summary from the TLDR InfoSec newsletter

WordPress security firm Wordfence has reported an actively exploited, critical unauthenticated arbitrary file upload vulnerability in the premium WordPress theme ‘Alone.' The vulnerability stems from the theme's `alone_import_pack_install_plugin()` function, which lacks nonce checks, is exposed via a `wp_ajax_nopriv_hook`, and permits plugin installation via AJAX. Attackers exploit the flaw by sending a POST request with a remote source URL pointing to an attacker-controlled file with webshells or other payloads.