CVE-2024-54263

7.5 HIGH

📋 TL;DR

This CVE describes a PHP Local File Inclusion vulnerability in the Talemy Spirit Framework WordPress plugin. Attackers can exploit improper filename control in include/require statements to read sensitive files on the server. All WordPress sites using Spirit Framework version 1.2.13 or earlier are affected.

💻 Affected Systems

Products:
  • Talemy Spirit Framework WordPress Plugin
Versions: n/a through 1.2.13
Operating Systems: All operating systems running PHP
Default Config Vulnerable: ⚠️ Yes
Notes: Requires WordPress installation with Spirit Framework plugin enabled. PHP configuration with allow_url_include disabled does not prevent local file inclusion.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise via reading sensitive files like /etc/passwd, database credentials, or session files, potentially leading to remote code execution.

🟠

Likely Case

Information disclosure of sensitive server files, configuration files, or source code.

🟢

If Mitigated

Limited impact if file permissions are restrictive and sensitive files are properly protected.

🌐 Internet-Facing: HIGH - WordPress plugins are typically internet-facing and this vulnerability requires no authentication.
🏢 Internal Only: MEDIUM - Internal systems could still be vulnerable if accessed by authenticated users.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation is straightforward via crafted HTTP requests. Public proof-of-concept exists in vulnerability databases.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.2.14 or later

Vendor Advisory: https://patchstack.com/database/wordpress/plugin/spirit-framework/vulnerability/wordpress-spirit-framework-plugin-1-2-13-local-file-inclusion-vulnerability?_s_id=cve

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Spirit Framework' and click 'Update Now'. 4. Verify version is 1.2.14 or higher.

🔧 Temporary Workarounds

Disable Plugin

all

Temporarily disable the Spirit Framework plugin until patched.

wp plugin deactivate spirit-framework

Web Application Firewall Rule

all

Block requests containing path traversal sequences in Spirit Framework endpoints.

🧯 If You Can't Patch

  • Implement strict file permissions to limit readable files on the server
  • Deploy web application firewall with rules to detect and block LFI patterns

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Spirit Framework → Version. If version is 1.2.13 or lower, system is vulnerable.

Check Version:

wp plugin list --name=spirit-framework --field=version

Verify Fix Applied:

Verify plugin version is 1.2.14 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

  • HTTP requests to Spirit Framework endpoints with ../ sequences
  • Unusual file access patterns in PHP error logs

Network Indicators:

  • HTTP requests containing path traversal patterns (../, ..\) to plugin endpoints

SIEM Query:

source="web_access_logs" AND uri="*spirit-framework*" AND (uri="*../*" OR uri="*..\*")

📊 Metadata

CVE ID: CVE-2024-54263
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-98
Published: February 2, 2026
Last Updated: February 4, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share This