PT-2025-40464 · WordPress · Spirit Framework

Tonn · CVE-2025-6388 · Published 2025-10-03 · Updated 2025-11-09

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spirit Framework plugin for WordPress versions through 1.2.14

Description The Spirit Framework plugin for WordPress is susceptible to an authentication bypass. This occurs because the custom actions() function does not adequately validate user identity before granting access. This allows unauthenticated attackers to log in as any user, including administrators, if they know the user's username. Reports indicate this issue is being actively exploited.

Recommendations Versions prior to 1.2.15 are affected. Update to version 1.2.15 or later. As a temporary measure, disable the Spirit Framework plugin until a patch can be applied.

Fix

LPE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-6388

Affected Products

Spirit Framework

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-6388 · Security Note
• https://twitter.com/CveFindCom/status/1974031849530839064 · Twitter Post
• https://themespirit.com/talemy-changelog · Note
• https://twitter.com/CVEnew/status/1974032783090598110 · Twitter Post
• https://twitter.com/cracbot/status/1975878887176335659 · Twitter Post
• https://t.me/CVEtracker/34001 · Telegram Post
• https://twitter.com/flamepycrack_/status/1974277487254462731 · Twitter Post
• https://twitter.com/PurpleOps_io/status/1974369293635584083 · Twitter Post
• https://twitter.com/Komodosec/status/1987551553356767488 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a4cbc0e7-4328-451f-a595-1ce17e9d0031?source=cve · Note
• https://twitter.com/offseq/status/1974037337362358397 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1974065008108613648 · Twitter Post
• https://twitter.com/SecAideInfo/status/1974779841229578742 · Twitter Post
• https://t.me/pentestingnews/69048 · Telegram Post
• https://twitter.com/0dayPublishing/status/1974031412715032999 · Twitter Post