CVE-2025-6388

CRITICAL EXPLOITED

Spirit Framework plugin - Auth Bypass

Title source: llm
STIX 2.1

Description

The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username.

Scores

CVSS v3 9.8
EPSS 0.0053
EPSS Percentile 67.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2025-10-02
CWE
CWE-288
Status published
Products (1)
Theme-Spirit/Spirit Framework < 1.2.14
Published Oct 03, 2025
Tracked Since Feb 18, 2026