CVE-2025-24690
Published: 26 March 2025
Summary
CVE-2025-24690 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and correction of the PHP Local File Inclusion flaw in the Formality WordPress plugin, preventing exploitation through patching.
Mandates validation of user-supplied filename inputs to PHP include/require statements, blocking malicious local file inclusion attempts.
Enforces restrictive PHP configuration settings like open_basedir to limit the directories accessible via improper file includes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remotely exploitable LFI vulnerability in a public-facing WordPress plugin, directly enabling T1190. The file inclusion mechanism facilitates reading arbitrary local files, mapping to T1005.
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through <= 1.5.7.
Deeper analysisAI
CVE-2025-24690 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, specifically a PHP Local File Inclusion issue (CWE-98), in the Formality WordPress plugin developed by Michele Giorgi. This flaw affects all versions of the plugin from n/a through 1.5.7. Published on 2025-03-26, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts despite requiring high attack complexity.
The vulnerability can be exploited by unauthenticated remote attackers (PR:N) over the network (AV:N) without user interaction (UI:N), though it demands high complexity (AC:H) and maintains unchanged scope (S:U). Successful exploitation enables high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), allowing attackers to perform local file inclusion on the targeted system.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/formality/vulnerability/wordpress-formality-plugin-1-5-7-local-file-inclusion-vulnerability?_s_id=cve, which documents the vulnerability in the WordPress Formality plugin version 1.5.7.
Details
- CWE(s)