CVE-2024-54263
Published: 02 February 2026
Summary
CVE-2024-54263 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-54263 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Talemy Spirit Framework. This affects the Spirit Framework WordPress plugin in all versions from n/a through 1.2.13. The issue stems from inadequate validation of filenames used in PHP include/require statements, mapped to CWE-98.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network with high attack complexity, low privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. An attacker with low-privileged access, such as a contributor role in WordPress, can exploit this to include and potentially execute arbitrary local files on the server, leading to sensitive data disclosure, server-side code execution, or full system compromise depending on the targeted files and server configuration.
Patchstack has documented this vulnerability in their database for the WordPress Spirit Framework plugin version 1.2.13, providing details on the local file inclusion issue and likely recommending updates or patches where available, though specific mitigation steps are outlined in their advisory at the referenced URL.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-55394
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Talemy Spirit Framework allows PHP Local File Inclusion.This issue affects Spirit Framework: from n/a through 1.2.13.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct LFI in public-facing WordPress plugin enables remote exploitation of the web application for code execution or data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied filenames in PHP include/require statements to prevent improper control leading to local file inclusion.
Mandates identification, reporting, and timely correction of the specific flaw in Talemy Spirit Framework versions through 1.2.13.
Enforces restrictions on information inputs such as filename parameters to block path traversal and arbitrary local file inclusion exploits.