CVE-2025-48157
Published: 20 August 2025
Summary
CVE-2025-48157 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the PHP local file inclusion vulnerability in the Formality WordPress plugin by requiring timely installation of security patches for affected versions up to 1.5.9.
Prevents exploitation of improper filename controls in PHP include/require statements by validating inputs to block malicious local file paths.
Mitigates file inclusion risks through secure configuration of PHP settings like open_basedir restrictions and disabled dangerous functions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI/RFI vuln in public-facing WordPress plugin enables remote code execution by including/executing arbitrary PHP files, mapping directly to T1190 and Unix shell command interpreters.
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through <= 1.5.9.
Deeper analysisAI
CVE-2025-48157 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, affecting the Formality WordPress plugin by Michele Giorgi. This flaw impacts all versions of the plugin from n/a through 1.5.9 inclusive. Published on 2025-08-20, it is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network without requiring user interaction, though exploitation demands high attack complexity. Successful attacks can result in high impacts to confidentiality, integrity, and availability, potentially allowing attackers to include and execute local files on the server.
The Patchstack advisory provides details on this WordPress Formality 1.5.9 local file inclusion vulnerability, including recommended mitigations such as updating the plugin.
Details
- CWE(s)