Spirit Framework vulnerabilities

2 known vulnerabilities in Spirit Framework from Theme-Spirit. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Spirit Framework: Authentication Bypass Using an Alternate Path or Channel

  CVE-2025-6388Oct 3, 2025Theme-Spirit

  The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This

• 7.5 High severity

  Spirit Framework: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2025-10269Sep 12, 2025Theme-Spirit

  The Spirit Framework plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php file