WP with Spritz 1.0 includes a remote file inclusion flaw that permits attackers without authentication to read arbitrary files. The vulnerability arises from unsanitized url parameters in the wp.spritz.content.filter.php page. On exploitation, an adversary can retrieve sensitive files such as system configuration and credentials, compromising confidentiality and potentially enabling further attacks.

The flaw affects the WordPress plugin WP with Spritz, version 1.0, which is installed on WordPress sites. Any site running this plugin is susceptible; no other vendor or product versions are noted as affected.

The CVSS base score is 8.7, indicating high severity. EPSS is not available, so the current exploitation probability is uncertain, but the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw simply by sending crafted GET requests to the plugin’s endpoint, so unauthenticated remote exploitation is feasible.