CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username.
Explanation of Vulnerability in Simple Terms
The Spirit Framework contains an authentication bypass vulnerability affecting versions 0 through 1.2.14. An attacker can gain unauthorized access to the framework without valid credentials due to improper authentication handling. This allows complete compromise of confidentiality, integrity, and availability. Update to a version newer than 1.2.14 immediately.
What an attacker can do
Gain full unauthorized access to the framework and read, modify, or delete all data without credentials.
Potential impact on your site
Complete compromise of the site: attackers can read all data, modify content, and take the site offline.
Conditions required to exploit
Network access only; no authentication, user interaction, or special configuration required.
Key dates
External resources
