Vulnerability in Wp-With-Spritz Wp With Spritz
CVE-2018-25329
WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting file paths into the url parameter. Attackers can send GET requests to wp.spritz.content.filter.php with malicious url values to access sensitive files like system configuration and credentials.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (31.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 32nd percentile — 31.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Wp-With-Spritz Wp With Spritz — versions 1.0
Weakness classification (CWE)
References
- downloads.wordpress.org/plugin/wp-with-spritz.zip (product)
- www.exploit-db.com/exploits/44544 (exploit)
- www.vulncheck.com/advisories/wordpress-plugin-wp-with-spritz-remote-file-inclus… (third-party-advisory)
Frequently asked questions
- What is CVE-2018-25329?
- CVE-2018-25329 is a high-severity vulnerability in Wp-With-Spritz Wp With Spritz, classified under PHP Remote File Inclusion. CVSS score: 7.5/10. Published 2026-05-17.
- How severe is CVE-2018-25329?
- High severity. CVSS v3 base score is 7.5 out of 10.