CVE-2025-48157
Published: 20 August 2025
Summary
CVE-2025-48157 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-48157 is a PHP Local File Inclusion vulnerability arising from improper control of filenames in include/require statements, tracked as CWE-98. It affects the Formality WordPress plugin developed by Michele Giorgi, with all versions through 1.5.9 impacted. The flaw carries a CVSS 3.1 score of 8.1, reflecting network-accessible attack vectors that require no authentication or user interaction yet can produce high impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input to force the plugin to include arbitrary local PHP files on the server. Successful exploitation may allow reading sensitive configuration data, executing attacker-controlled code, or fully compromising the affected WordPress site.
The sole reference points to a Patchstack advisory that catalogs the issue for the WordPress plugin. Exploitation probability (EPSS) rose from lower values after disclosure to a peak of 0.0540 on 2026-05-12 before receding to the current 0.0326, indicating measurable post-publication attacker interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25375
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through <= 1.5.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI/RFI vuln in public-facing WordPress plugin enables remote code execution by including/executing arbitrary PHP files, mapping directly to T1190 and Unix shell command interpreters.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the PHP local file inclusion vulnerability in the Formality WordPress plugin by requiring timely installation of security patches for affected versions up to 1.5.9.
Prevents exploitation of improper filename controls in PHP include/require statements by validating inputs to block malicious local file paths.
Mitigates file inclusion risks through secure configuration of PHP settings like open_basedir restrictions and disabled dangerous functions.