PT-2026-27177 · WordPress · Sprig Plugin For Craft Cms

Neosprings · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-27131

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sprig Plugin for Craft CMS versions prior to 2.15.2 Sprig Plugin for Craft CMS versions prior to 3.15.2

Description The Sprig Plugin for Craft CMS allows admin users and those with Sprig Playground access to potentially reveal security keys, credentials, and other sensitive configuration data. The hashData() function can also be executed. This issue was addressed by disabling Sprig Playground access when devMode is disabled, with a configuration option (enablePlaygroundWhenDevModeDisabled) to override this behavior.

Recommendations Update to Sprig Plugin for Craft CMS version 2.15.2 or later. Update to Sprig Plugin for Craft CMS version 3.15.2 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-489

CWE-200

Related Identifiers

CVE-2026-27131

GHSA-M59H-42JF-CPHR

Affected Products

Sprig Plugin For Craft Cms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27131.json · Exploit
• https://osv.dev/vulnerability/GHSA-m59h-42jf-cphr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27131 · Security Note
• https://github.com/putyourlightson/craft-sprig · Note
• https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475 · Note
• https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr · Note
• https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b · Note