Actively Exploited: Critical Flaw CVE-2025-6388 (CVSS 9.8) Allows Authentication Bypass in WordPress Plugin

Actively Exploited: Critical Flaw CVE-2025-6388 (CVSS 9.8) in the Spirit Framework WordPress plugin has put thousands of websites at immediate risk of compromise, according to the report. The vulnerability lies in improper identity validation within the custom_actions() function and affects all versions up to and including 1.2.14 of the Spirit Framework plugin.

According to Wordfence, active exploitation has been confirmed, with the security firm reporting: “Wordfence blocked 20 attacks targeting this vulnerability in the past 24 hours.” In practical terms, an attacker who knows the username of a valid account—such as an administrator—can log in without the corresponding password, enabling account takeover and privilege escalation to administrator.

The developers have released Spirit Framework version 1.2.15, which includes a patch to properly validate user identities before granting authentication, and website administrators are urged to update immediately to mitigate defacement, data theft, or malware deployment.