CVE-2025-6388
Last modified
CVE-2025-6388 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-6388?
How severe is CVE-2025-6388?
How do I fix CVE-2025-6388?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-6385The WP Applink plugin for WordPress is vulnerable to Stored …6.4
- CVE-2025-6386The parisneo/lollms repository is affected by a timing attac…7.5
- CVE-2025-6387The WP Get The Table plugin for WordPress is vulnerable to S…6.4
- CVE-2025-63872DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability…6.1
- CVE-2025-63878Github Restaurant Website Restoran v1.0 was discovered to co…6.5
- CVE-2025-63879A reflected cross-site scripted (XSS) vulnerability in the /…6.1
- CVE-2025-63883A DOM-based cross-site scripting vulnerability exists in ele…5.4
- CVE-2025-63885A stored cross-site scripting (XSS) vulnerability in AIxBloc…6.1
- CVE-2025-63888The read function in file thinkphp\library\think\template\dr…9.8
- CVE-2025-63889The fetch function in file thinkphp\library\think\Template.p…7.5
- CVE-2025-6389The Sneeit Framework plugin for WordPress is vulnerable to R…9.8
- CVE-2025-63891Information Disclosure in web-accessible backup file in Sour…7.5
Are you affected by CVE-2025-6388?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST