CVE-2024-54263
Unknown Unknown - Not Provided
Local File Inclusion in Talemy Spirit Framework

Publication date: 2026-02-02

Last updated on: 2026-02-02

Assigner: Patchstack

Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Talemy Spirit Framework allows PHP Local File Inclusion.This issue affects Spirit Framework: from n/a through 1.2.13.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-02
Last Modified
2026-02-02
Generated
2026-06-16
AI Q&A
2026-02-02
EPSS Evaluated
2026-06-14
NVD
CVE-2024-54263
EUVD
EUVD-2024-55394
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack spirit_framework From 1.0.0 (inc) to 1.2.13 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2024-54263 is a Local File Inclusion (LFI) vulnerability in the WordPress Spirit Framework Plugin up to version 1.2.13. It allows an attacker with subscriber or developer privileges to include and display local files from the target website. This can expose sensitive information such as database credentials and potentially lead to a complete database takeover depending on the website's configuration. [1]

Impact Analysis

This vulnerability can have a severe impact by allowing attackers to access sensitive files on your server, including database credentials. Exploiting this flaw could lead to a complete takeover of your database, compromising the confidentiality, integrity, and availability of your data and website. [1]

Mitigation Strategies

Since no official fix is currently available for this vulnerability in the Spirit Framework plugin, you should immediately apply the mitigation rule issued by Patchstack that can block attacks exploiting this vulnerability. This mitigation helps protect your website until an official patch is released. [1]

Compliance Impact

The vulnerability allows attackers to include and display local files, potentially exposing sensitive information such as database credentials. This exposure could lead to a complete database takeover depending on the website's configuration. Such unauthorized access and data exposure could result in non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding sensitive data against unauthorized access. Therefore, this vulnerability poses a risk to compliance with these common standards and regulations. [1]

Detection Guidance

This vulnerability can be detected by monitoring for attempts to exploit Local File Inclusion (LFI) in the Spirit Framework plugin, such as unusual requests attempting to include local files. While no specific detection commands are provided, applying Patchstack's mitigation rule can help block attacks exploiting this vulnerability. Network or web server logs should be inspected for suspicious include/require statements or requests containing file path traversal patterns targeting the Spirit Framework plugin. Since no official fix is available, using the mitigation rule is recommended to protect the system. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-54263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart