The plugin contains an authentication bypass that allows an attacker who knows a user’s username to log in without a password. The flaw originates from the custom_actions() routine that fails to verify the identity of the caller before creating a session. As a result, any attacker with unauthenticated access to the site can assume the identity of any existing user, including administrators, enabling full control over the WordPress installation. The weakness is a classic improper authentication condition (CWE-288).

Spirit Framework, a WordPress plugin provided by Theme‑Spirit, is affected in every release up to and including version 1.2.14. No other versions are mentioned, so installations of 1.2.14 or earlier are vulnerable.

The CVSS score of 9.8 indicates a very severe risk, requiring immediate response. The EPSS score is below 1 %, meaning that existing exploitation attempts are rare, but the absence of a KEV listing does not lessen the threat; attackers could still leverage the flaw. Based on the description, the likely attack vector is remote via the web interface, where anyone can craft a request that triggers the custom_actions() handler. An attacker only needs knowledge of a target’s username and does not need further privileges or software on the victim site.