CVE-2025-60206 describes an improper control of code generation vulnerability (code injection) in Beplusthemes Alone software versions up to 7.8.3. The vulnerability allows remote attackers to execute arbitrary code without authentication or user interaction, resulting in full compromise of the affected system. The CVSS v3.1 base score is 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or vendor advisory information is currently available.

Successful exploitation of this vulnerability could lead to complete system compromise, including unauthorized disclosure of information, modification of data, and disruption of service. Given the critical CVSS score and the nature of code injection, the impact is severe and could allow attackers full control over affected installations of Beplusthemes Alone up to version 7.8.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected application and monitoring for suspicious activity related to code injection attempts. Avoid exposing the vulnerable software to untrusted networks.