Loading story…
A critical security vulnerability, tracked as CVE-2025-6388, has been identified in the Spirit Framework plugin for WordPress, affecting all versions up to and including 1.2.14. The flaw is rooted in the custom_actions() function, which fails to properly validate user identities before authenticating them to the site. This oversight allows unauthenticated attackers to log in as any user, including administrators, provided they know the target username. The vulnerability has been assigned a CVSS score of 9.8, indicating its severe risk level. Security provider Wordfence has confirmed that this vulnerability is being actively exploited in the wild, having blocked 20 attack attempts within a 24-hour period. Attackers leveraging this flaw can bypass standard authentication mechanisms, seize control of user accounts, escalate privileges to administrator, and potentially install backdoors or inject malicious content. The widespread use of WordPress for enterprise, e-commerce, and personal websites amplifies the potential impact of this vulnerability. The Spirit Framework plugin is popular among WordPress site administrators, increasing the number of potentially affected sites. The developers have responded by releasing version 1.2.15 of the plugin, which patches the authentication bypass by ensuring proper identity validation. Website administrators are strongly urged to update to the latest version immediately to mitigate the risk of account takeover and privilege escalation. Failure to apply the patch leaves sites exposed to full compromise, including the risk of data theft, defacement, or further malware deployment. The vulnerability does not require knowledge of a password, only the username of a valid account, making exploitation relatively straightforward for attackers. The incident underscores the importance of prompt patch management and the risks associated with third-party plugins in widely used content management systems. Security advisories have been issued to alert the community, and monitoring for signs of compromise is recommended for sites running affected versions. The rapid exploitation observed highlights the need for continuous vigilance and timely response to critical vulnerabilities in the WordPress ecosystem. Organizations should review their plugin inventories and ensure all components are up to date to prevent similar incidents. The disclosure and patch release demonstrate effective collaboration between security researchers, vendors, and the broader WordPress community in addressing high-impact threats.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
The plugin vendor released Spirit Framework version 1.2.15 to fix the authentication bypass issue. Administrators were urged to update immediately to prevent takeover, defacement, malware deployment, and data theft.
Wordfence reported blocking 20 attack attempts targeting CVE-2025-6388 within a 24-hour period, indicating the vulnerability was being exploited in the wild. Successful exploitation could lead to account takeover, privilege escalation, and full site compromise.
A critical authentication bypass vulnerability, tracked as CVE-2025-6388, was identified in the Spirit Framework WordPress plugin. The flaw affects all versions up to and including 1.2.14 and allows login without the correct password if an attacker knows a valid username.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability, tracked as CVE-2025-5947, has been discovered and actively exploited in the Service Finder WordPress theme. This flaw allows unauthenticated attackers to gain access to any account on affected WordPress sites, including those with administrator privileges. The vulnerability stems from improper validation of the original_user_id cookie in the service_finder_switch_back() function, enabling privilege escalation and unauthorized account access. The Service Finder theme, which is widely used for service directory and job board websites, has been sold to over 6,000 customers via Envato Market, making the impact of this vulnerability significant. Security researcher 'Foxyyy' identified the issue and reported it through Wordfence’s bug bounty program on June 8, 2025. The vendor, Aonetheme, released a patch in version 6.1 on July 17, 2025, addressing the vulnerability for all versions prior to and including 6.0. Despite the patch, exploitation attempts began in earnest after public disclosure at the end of July, with Wordfence recording over 13,800 attack attempts since August 1, 2025. Attackers have been observed using specific IP addresses to target the vulnerable account switching function, and a surge of more than 1,500 daily attack attempts was noted for about a week starting September 23. The typical attack involves an HTTP GET request with a switch_back=1 query parameter, allowing the attacker to impersonate any user. Successful exploitation could allow attackers to hijack sites, insert malicious code, redirect users to phishing sites, or use compromised sites to host malware. The full extent of successful compromises remains unclear, but the scale of attempted exploitation highlights the urgency for administrators to update their themes. Administrators are strongly advised to audit their sites for suspicious activity, apply the latest patch, and monitor for unauthorized access. The vulnerability’s critical CVSS score of 9.8 underscores the risk to affected sites. The Service Finder theme’s popularity among active business sites increases the potential for widespread impact. Wordfence continues to monitor exploitation activity and has provided indicators of compromise, including a list of attacking IP addresses. The incident demonstrates the importance of timely patching and vigilant monitoring for WordPress site operators using third-party themes and plugins. Security firms recommend immediate action to mitigate the risk of site takeover and data compromise. The rapid exploitation following public disclosure illustrates the speed at which threat actors can weaponize newly revealed vulnerabilities in popular web platforms.
Jun 29, 2026
A critical authentication bypass vulnerability, **CVE-2024-10924**, was disclosed and fixed in the WordPress plugin **Really Simple Security**, affecting the Free, Pro, and Pro Multisite editions in versions `9.0.0` through `9.1.1.1`. The flaw carries a **CVSS 9.8** rating and can allow an unauthenticated attacker to log in as any user, including an administrator, on sites where the plugin’s two-factor authentication feature is enabled. The issue was traced to improper error handling in the `check_login_and_get_user` function within the plugin’s two-factor authentication REST API. Defenders warned that roughly **4 million** websites could be exposed, making the bug a high-priority patching issue for WordPress operators. Site owners were urged to update immediately to **version 9.1.2 or later** to close the vulnerability.
Jul 24, 2026
Threat actors are actively exploiting critical vulnerabilities in popular WordPress plugins and themes, enabling the hijacking of administrator accounts and full site compromise. The Post SMTP plugin, installed on over 400,000 WordPress sites, is affected by CVE-2025-11833, a flaw that allows unauthenticated attackers to read arbitrary logged emails, including password reset messages, due to missing authorization checks. This exposure enables attackers to reset admin passwords and take over sites. Wordfence has observed over 4,500 exploit attempts since November 1, and a patch was released in version 3.6.1, but a significant number of sites remain unpatched and vulnerable. Similarly, the JobMonster WordPress theme is being targeted via CVE-2025-5397, an authentication bypass vulnerability that allows attackers to hijack admin accounts when social login is enabled. The flaw arises from improper verification in the `check_login()` function, letting attackers fake admin access if they know the username or email. The issue is fixed in version 4.8.2, and users are urged to update, disable social login, and enable two-factor authentication. These incidents highlight the ongoing risk posed by unpatched WordPress components and the need for immediate mitigation to prevent site compromise.
Jun 29, 2026