PT-2026-27177 · WordPress · Sprig Plugin For Craft Cms

Neosprings · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2026-27131

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sprig Plugin for Craft CMS versions prior to 2.15.2 Sprig Plugin for Craft CMS versions prior to 3.15.2

Description The Sprig Plugin for Craft CMS allows admin users and those with Sprig Playground access to potentially reveal security keys, credentials, and other sensitive configuration data. The hashData() function can also be executed. This issue was addressed by disabling Sprig Playground access when devMode is disabled, with a configuration option (enablePlaygroundWhenDevModeDisabled) to override this behavior.

Recommendations Update to Sprig Plugin for Craft CMS version 2.15.2 or later. Update to Sprig Plugin for Craft CMS version 3.15.2 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-489

CWE-200

Identificadores relacionados

CVE-2026-27131

GHSA-M59H-42JF-CPHR

Produtos afetados

Sprig Plugin For Craft Cms

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27131.json · Exploit
• https://github.com/putyourlightson/craft-sprig · Nota
• https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475 · Nota
• https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr · Nota
• https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b · Nota
• https://osv.dev/vulnerability/GHSA-m59h-42jf-cphr · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-27131 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27131 · Nota de Segurança