CVE-2018-25329CWE-98

WordPress Plugin WP with Spritz 1.0 Remote File Inclusion

High · published May 17, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting file paths into the url parameter. Attackers can send GET requests to wp.spritz.content.filter.php with malicious url values to access sensitive files like system configuration and credentials.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Published
2026-05-17T12:11Z
EPSS history
Timeline
  • 17 MAY 12:11Z
    WordPress Plugin WP with Spritz 1.0 Remote File Inclusion
    cvelistv5