CVE-2025-48330
Published: 06 November 2025
Summary
CVE-2025-48330 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and correction of the PHP Local File Inclusion flaw in Real Time Validation for Gravity Forms plugin versions through 1.7.0.
Enforces validation of user-supplied filenames in PHP include/require statements to prevent arbitrary local file inclusion exploitation.
Vulnerability scanning detects the PHP Remote File Inclusion (Local File Inclusion) vulnerability in the affected WordPress plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress plugin enables public-facing app exploitation (T1190), arbitrary local file reads for data collection (T1005), and access to credentials in files like wp-config.php (T1552.001).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows PHP Local File Inclusion.This issue affects Real Time Validation for Gravity Forms: from n/a…
more
through <= 1.7.0.
Deeper analysisAI
CVE-2025-48330 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion (CWE-98), in the WordPress plugin Real Time Validation for Gravity Forms (real-time-validation-for-gravity-forms). The flaw enables PHP Local File Inclusion and affects all versions from n/a through 1.7.0 inclusive. Published on 2025-11-06, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote, unauthenticated attacker can exploit this vulnerability over the network, though it requires high attack complexity and user interaction. Exploitation allows inclusion of arbitrary local PHP files, potentially resulting in high-impact confidentiality, integrity, and availability violations, such as unauthorized access to sensitive data or code execution depending on the included files.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/real-time-validation-for-gravity-forms/vulnerability/wordpress-real-time-validation-for-gravity-forms-1-7-0-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)