PT-2025-29897 · Alone+1 · Alone+1

Trương Hữu Phúc + 1 · Published 2025-07-17 · Updated 2025-07-22 · CVE-2025-5396

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bears Backup versions prior to 2.0.1

Description The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.0.0. This is due to the bbackup ajax handle() function lacking capability checks and proper validation of user-supplied input, which is directly passed to call user func(). This allows unauthenticated attackers to execute code on the server, potentially enabling them to inject backdoors or create new administrative user accounts. On WordPress sites using the Alone theme version 7.8.4 and older, this issue can be chained with another vulnerability to install the Bears Backup plugin and achieve the same impact.

Recommendations Update to Bears Backup version 2.0.1 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-5396

Affected Products

Alone

Bears Backup

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-5396 · Security Note
• https://t.me/cvetracker/28017 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/81b44abb-6d30-4930-b68b-9a04d93f5169?source=cve · Note
• https://t.me/cvenotify/129259 · Telegram Post
• https://themeforest.net/item/alone-charity-multipurpose-nonprofit-wordpress-theme/15019939 · Note
• https://twitter.com/cracbot/status/1947612628026855836 · Twitter Post
• https://twitter.com/CVEnew/status/1945681880298508376 · Twitter Post