PT-2026-41555 · WordPress · Spritz

Published 2026-05-17 · Updated 2026-05-17 · CVE-2018-25329

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP with Spritz version 1.0

Description An issue in the WP with Spritz plugin allows unauthenticated attackers to read arbitrary files. This is achieved by injecting file paths into the url parameter via GET requests sent to the 'wp.spritz.content.filter.php' endpoint. This can lead to the exposure of sensitive information, such as system configurations and credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2018-25329

Affected Products

Spritz

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25329 · Security Note
• https://vulncheck.com/advisories/wordpress-plugin-wp-with-spritz-remote-file-inclusion · Note
• https://exploit-db.com/exploits/44544 · Note
• https://downloads.wordpress.org/plugin/wp-with-spritz.zip · Note
• https://t.me/CVEtracker/54054 · Telegram Post