CVE-2025-6388Critical· 9.8▾ MidnightThe Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
Last analysed / modified upstream
The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55186Medium· 4.2MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
CVE-2026-63190Critical· 9.4FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
CVE-2026-118681Low· 3.7go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware
CVE-2026-25439High· 8.1WordPress Booknetic plugin < 5.10.4 - Broken Authentication vulnerability
CVE-2026-107671High· 8.5A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.
CVE-2026-93866Critical· 9.2Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write