CVE-2024-54263
Local File Inclusion in Talemy Spirit Framework
Publication date: 2026-02-02
Last updated on: 2026-02-02
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | spirit_framework | From 1.0.0 (inc) to 1.2.13 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2024-54263 is a Local File Inclusion (LFI) vulnerability in the WordPress Spirit Framework Plugin up to version 1.2.13. It allows an attacker with subscriber or developer privileges to include and display local files from the target website. This can expose sensitive information such as database credentials and potentially lead to a complete database takeover depending on the website's configuration. [1]
How can this vulnerability impact me? :
This vulnerability can have a severe impact by allowing attackers to access sensitive files on your server, including database credentials. Exploiting this flaw could lead to a complete takeover of your database, compromising the confidentiality, integrity, and availability of your data and website. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix is currently available for this vulnerability in the Spirit Framework plugin, you should immediately apply the mitigation rule issued by Patchstack that can block attacks exploiting this vulnerability. This mitigation helps protect your website until an official patch is released. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to include and display local files, potentially exposing sensitive information such as database credentials. This exposure could lead to a complete database takeover depending on the website's configuration. Such unauthorized access and data exposure could result in non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding sensitive data against unauthorized access. Therefore, this vulnerability poses a risk to compliance with these common standards and regulations. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for attempts to exploit Local File Inclusion (LFI) in the Spirit Framework plugin, such as unusual requests attempting to include local files. While no specific detection commands are provided, applying Patchstack's mitigation rule can help block attacks exploiting this vulnerability. Network or web server logs should be inspected for suspicious include/require statements or requests containing file path traversal patterns targeting the Spirit Framework plugin. Since no official fix is available, using the mitigation rule is recommended to protect the system. [1]