Local File Inclusion Vulnerability in Spirit Framework Plugin for WordPress

CVE-2025-10269

What is CVE-2025-10269?

The Spirit Framework plugin for WordPress is susceptible to a serious Local File Inclusion vulnerability in all versions up to 1.2.13. Authenticated users with Subscriber-level access or higher are able to exploit this vulnerability, allowing them to include and execute arbitrary .php files stored on the server. This exploitation can lead to access control bypass, enabling attackers to retrieve sensitive information or execute malicious PHP code through files that they can upload. It is crucial for users and website administrators to take preventive measures to secure their installations against potential threats associated with this vulnerability.

References