CVE-2025-10269: Spirit Framework <= 1.2.13 - Authenticated (Subscriber+) Local File Inclusion
The Spirit Framework plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10269?
The severity of CVE-2025-10269 is considered high due to the potential for authenticated attackers to execute arbitrary PHP files on the server.
How do I fix CVE-2025-10269?
To fix CVE-2025-10269, update the Spirit Framework plugin to version 1.2.14 or higher.
What systems are affected by CVE-2025-10269?
CVE-2025-10269 affects all versions of the Spirit Framework plugin for WordPress up to and including version 1.2.13.
Who can exploit CVE-2025-10269?
CVE-2025-10269 can be exploited by authenticated users with Subscriber-level access and above.
What kind of attack is possible with CVE-2025-10269?
CVE-2025-10269 allows attackers to perform Local File Inclusion, enabling them to include and execute arbitrary PHP files on the server.