CVE-2025-6388

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6388", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-20T00:46:48.403Z", "datePublished": "2025-10-03T08:23:49.620Z", "dateUpdated": "2026-04-08T17:13:09.342Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:09.342Z"}, "affected": [{"vendor": "Theme-Spirit", "product": "Spirit Framework", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username."}], "title": "Spirit Framework <= 1.2.14 - Authentication Bypass to Account Takeover and Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cbc0e7-4328-451f-a595-1ce17e9d0031?source=cve"}, {"url": "https://themespirit.com/talemy-changelog/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "cweId": "CWE-288", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tonn"}], "timeline": [{"time": "2025-06-25T15:52:07.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-02T19:26:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T15:56:11.354671Z", "id": "CVE-2025-6388", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T15:56:24.432Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6388", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T15:56:11.354671Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T15:56:16.977Z"}}], "cna": {"title": "Spirit Framework <= 1.2.14 - Authentication Bypass to Account Takeover and Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Tonn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Theme-Spirit", "product": "Spirit Framework", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-25T15:52:07.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-02T19:26:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cbc0e7-4328-451f-a595-1ce17e9d0031?source=cve"}, {"url": "https://themespirit.com/talemy-changelog/"}], "descriptions": [{"lang": "en", "value": "The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:09.342Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6388", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:13:09.342Z", "dateReserved": "2025-06-20T00:46:48.403Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T08:23:49.620Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Spirit Framework", "vendor": "Theme-Spirit", "versions": [{"lessThanOrEqual": "1.2.14", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username."}, {"lang": "es", "value": "El plugin Spirit Framework para WordPress es vulnerable a una omisi\u00f3n de autenticaci\u00f3n en todas las versiones hasta la 1.2.14, inclusive. Esto se debe a que la funci\u00f3n custom_actions() no valida correctamente la identidad de un usuario antes de autenticarlos en el sitio. Esto permite que atacantes no autenticados inicien sesi\u00f3n como cualquier usuario, incluidos los administradores, siempre que tengan acceso al nombre de usuario del administrador."}], "id": "CVE-2025-6388", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6388", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T15:56:11.354671Z", "version": "2.0.3"}}]}, "published": "2025-10-03T09:15:38.300", "references": [{"source": "security@wordfence.com", "url": "https://themespirit.com/talemy-changelog/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cbc0e7-4328-451f-a595-1ce17e9d0031?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:23:54.548502+00:00", "value": {"mitigation_remediation": ["Upgrade or replace Spirit Framework with a version that does not contain the authentication bypass (any release newer than 1.2.14).", "If an update is not available, disable or uninstall the vulnerable plugin to remove the attack surface entirely.", "Until the plugin can be removed or patched, restrict administrator access to known IP addresses or use a Web Application Firewall to block unauthenticated access to the custom_actions endpoint."], "summary": {"action": "Immediate Patch", "impact": "Account takeover and privilege escalation via authentication bypass"}, "threat_synthesis": {"affected_systems": "Spirit Framework, a WordPress plugin provided by Theme\u2011Spirit, is affected in every release up to and including version 1.2.14. No other versions are mentioned, so installations of 1.2.14 or earlier are vulnerable.", "description_and_impact": "The plugin contains an authentication bypass that allows an attacker who knows a user\u2019s username to log in without a password. The flaw originates from the custom_actions() routine that fails to verify the identity of the caller before creating a session. As a result, any attacker with unauthenticated access to the site can assume the identity of any existing user, including administrators, enabling full control over the WordPress installation. The weakness is a classic improper authentication condition (CWE-288).", "risk_and_exploitability": "The CVSS score of 9.8 indicates a very severe risk, requiring immediate response. The EPSS score is below 1\u202f%, meaning that existing exploitation attempts are rare, but the absence of a KEV listing does not lessen the threat; attackers could still leverage the flaw. Based on the description, the likely attack vector is remote via the web interface, where anyone can craft a request that triggers the custom_actions() handler. An attacker only needs knowledge of a target\u2019s username and does not need further privileges or software on the victim site."}}}}, "created": "2025-10-06T14:43:14.219202+00:00", "updated": "2026-04-20T19:30:06.166856+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}