Overview
The Spirit Framework plugin for WordPress, a popular tool used by many websites, has been discovered to be vulnerable to Local File Inclusion (LFI). As a significant number of websites use WordPress and its plugins, this vulnerability can potentially affect a wide range of users and systems. The presence of this vulnerability can lead to severe consequences such as system compromise and data leakage if exploited.
Vulnerability Summary
CVE ID: CVE-2025-10269
Severity: High (CVSS: 7.5)
Attack Vector: Local File Inclusion
Privileges Required: Subscriber-level access and above
User Interaction: Required
Impact: Possible system compromise or data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Spirit Framework plugin for WordPress | All versions up to and including 1.2.13
How the Exploit Works
An attacker with Subscriber-level access or above can exploit this vulnerability by including and executing arbitrary .php files on the server. This can lead to the execution of any PHP code in those files, effectively allowing the attacker to bypass access controls, obtain sensitive data, or execute code if .php file types can be uploaded and included.
Conceptual Example Code
Here is a conceptual example of exploiting this vulnerability. Note that this is a simplified illustration and actual attacks can be more complex:
POST /wp-content/plugins/spirit-framework/includes/load.php HTTP/1.1
Host: target.example.com
Content-Type: application/php
{ "include_file": "/path/to/malicious/file.php" }In this example, an attacker sends a POST request to the vulnerable endpoint and includes the path to a malicious .php file that they’ve uploaded to the server. This results in the malicious file being executed on the server, leading to potential compromise.