The Spirit Framework WordPress plugin is vulnerable to local file inclusion in all versions up to and including 1.2.13. Authenticated users with Subscriber-level access or higher can cause the plugin to include and execute arbitrary .php files stored on the server. This can be exploited to bypass access controls, read sensitive data, or run arbitrary PHP code if .php files are uploaded and then included. The weakness is a classic local file inclusion flaw (CWE‑98).

All installations of the Theme‑Spirit Spirit Framework plugin for WordPress running version 1.2.13 or older are affected. The vulnerability applies to the plugin’s file inclusion logic that is triggered for authenticated subscribers and above.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of less than 1% suggests that the probability of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate with a Subscriber‑level account and then upload or place a PHP file in a location that the plugin can include, after which the arbitrary code runs with the permissions of the web server.