CVE-2025-60206: 
WordPress vulnerability analysis and mitigation

CVE-2025-60206 is a critical code injection (Remote Code Execution) vulnerability in the Beplusthemes/Bearsthemes "Alone" WordPress theme. It affects all versions of the Alone theme up to and including 7.8.3, allowing unauthenticated remote attackers to inject and execute arbitrary code. The vulnerability was reported on June 16, 2025, by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) and published by Patchstack on July 16, 2025, with CVE assignment on October 22, 2025. It carries a CVSS v3.1 base score of 10.0 (Critical), assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), meaning the Alone theme fails to properly sanitize or validate user-supplied input before using it in a code generation or evaluation context. This allows a remote, unauthenticated attacker to inject malicious code that is subsequently executed by the server. The attack vector is network-based, requires no privileges and no user interaction, and has a changed scope — indicating that a successful exploit can impact resources beyond the vulnerable component itself. No detailed technical write-up or public PoC code has been disclosed at this time (Patchstack, NVD).

Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary commands on the underlying server, resulting in full confidentiality, integrity, and availability compromise. Attackers could gain persistent backdoor access, steal sensitive data (including credentials and customer information), deface the website, install malware, or pivot to other systems on the same hosting infrastructure. Given the unauthenticated nature of the vulnerability and its perfect CVSS score, it is considered suitable for mass-exploitation campaigns targeting WordPress sites regardless of their size or traffic (Patchstack).

As of the available information, no public proof-of-concept exploit code has been published and no confirmed in-the-wild exploitation has been observed. The EPSS score is approximately 0.039%, reflecting a currently low but non-negligible probability of exploitation in the near term. The vulnerability has not been listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that vulnerabilities of this type (unauthenticated RCE with CVSS 10) are frequently targeted in mass-exploit campaigns against WordPress sites (Patchstack, NVD).

As of the Patchstack advisory, no official patch from the theme developer (Beplusthemes/Bearsthemes) is available for the Alone theme. Immediate recommended actions include: (1) updating the Alone theme to any version beyond 7.8.3 if a patched release becomes available; (2) temporarily disabling the theme if no update is available; (3) deploying a Web Application Firewall (WAF) — Patchstack has issued a virtual patch/mitigation rule to block exploitation attempts for Patchstack subscribers; and (4) conducting a security audit of the affected site to check for signs of prior compromise. Hosting providers or web developers should be consulted if immediate remediation is not feasible (Patchstack).

The vulnerability was discovered and responsibly disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, and reported through Patchstack's vulnerability disclosure program. Patchstack has classified it as high priority and issued a virtual mitigation rule for its users, noting the potential for mass-exploitation campaigns. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).