Theme-Spirit vulnerabilities
We track 2 vulnerabilities in Theme-Spirit products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 3, 2025.
2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score
Latest Theme-Spirit vulnerabilities
- 9.8 Critical severity
Spirit Framework: Authentication Bypass Using an Alternate Path or Channel
The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This
- 7.5 High severity
Spirit Framework: Improper Control of Filename for Include/Require Statement in PHP Program
The Spirit Framework plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php file