CVE-2025-48157
published 2025-08-20CVE-2025-48157: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality…
PriorityP357high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EXPLOIT
EPSS
2.04%
78.7th percentile
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through <= 1.5.9.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| michele_giorgi | formality | <= 1.5.9 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
WordPress Formality Plugin <= 1.5.9 - Local File Inclusion
nuclei·CVSS 8.1
CVE-2025-48157 [HIGH] WordPress Formality Plugin <= 1.5.9 - Local File Inclusion
WordPress Formality Plugin <= 1.5.9 - Local File Inclusion
Michele Giorgi Formality <= 1.5.9 contains a file inclusion vulnerability caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires crafted input.
Template:
id: CVE-2025-48157
info:
name: WordPress Formality Plugin <= 1.5.9 - Local File Inclusion
author: pussycat0x
severity: critical
description: |
Michele Giorgi Formality <= 1.5.9 contains a file inclusion vulnerability caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires crafted input.
impact:
Attackers can include local files, potentially leading to code execution or information disclosure.
remediation:
Update to the latest version beyo
No writeups or analysis indexed.
2025-08-20
Published