PT-2025-37275 · WordPress · Spirit Framework

Bonds · Published 2025-09-12 · Updated 2025-09-17 · CVE-2025-10269

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Spirit Framework plugin for WordPress versions through 1.2.13

Description: The Spirit Framework plugin for WordPress is susceptible to Local File Inclusion. Authenticated attackers with Subscriber-level access or higher can include and execute arbitrary .php files on the server. This allows for the execution of PHP code within those files, potentially bypassing access controls and obtaining sensitive data. In scenarios where .php file uploads are permitted, this can lead to code execution.

Recommendations: Update Spirit Framework plugin to a version later than 1.2.13.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-10269

Affected Products

Spirit Framework

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10269 · Security Note
• https://twitter.com/cracbot/status/1968268742644707350 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/38391221-c435-4672-809a-ebabf639c9bb?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1966413785737916547 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/spirit-framework/vulnerability/wordpress-spirit-framework-plugin-1-2-13-local-file-inclusion-vulnerability · Note