Authentication vulnerability in Spirit Framework 1.2.14

The plugin called “Spirit Framework” for WordPress has a security flaw in all versions up to 1.2.14. This means that anyone can bypass the login process and access the site without entering the correct credentials. The problem is caused by a function called “custom_actions()” which doesn’t check if the user is who they claim to be before allowing them to log in. This means that even users without an account can log in as any user, including administrators, as long as they know the administrator’s username.