{"id":86969,"date":"2026-04-22T22:00:23","date_gmt":"2026-04-22T22:00:23","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-10269-spirit-framework-plugin-for-wordpress-local-file-inclusion-vulnerability","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-10269-spirit-framework-plugin-for-wordpress-local-file-inclusion-vulnerability\/","title":{"rendered":"CVE-2025-10269: Spirit Framework Plugin for WordPress Local File Inclusion Vulnerability<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Spirit Framework plugin for WordPress, a popular tool used by many websites, has been discovered to be vulnerable to Local File Inclusion (LFI). As a significant number of websites use WordPress and its plugins, this vulnerability can potentially affect a wide range of users and systems. The presence of this vulnerability can lead to severe consequences such as system compromise and data leakage if exploited.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-10269
\nSeverity: High (CVSS: 7.5)
\nAttack Vector: Local File Inclusion
\nPrivileges Required: Subscriber-level access and above
\nUser Interaction: Required
\nImpact: Possible system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Spirit Framework plugin for WordPress | All versions up to and including 1.2.13<\/p>\n

How the Exploit Works<\/strong><\/p>\n

An attacker with Subscriber-level access or above can exploit this vulnerability by including and executing arbitrary .php files on the server. This can lead to the execution of any PHP code in those files, effectively allowing the attacker to bypass access controls, obtain sensitive data, or execute code if .php file types can be uploaded and included.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is a conceptual example of exploiting this vulnerability. Note that this is a simplified illustration and actual attacks can be more complex:<\/p>\n

POST \/wp-content\/plugins\/spirit-framework\/includes\/load.php HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/php\n{ \"include_file\": \"\/path\/to\/malicious\/file.php\" }<\/code><\/pre>\n
In this example, an attacker sends a POST request to the vulnerable endpoint and includes the path to a malicious .php file that they’ve uploaded to the server. This results in the malicious file being executed on the server, leading to potential compromise.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Spirit Framework plugin for WordPress, a popular tool used by many websites, has been discovered to be vulnerable to Local File Inclusion (LFI). As a significant number of websites use WordPress and its plugins, this vulnerability can potentially affect a wide range of users and systems. The presence of this vulnerability can lead […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86969","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t