# CVE-2025-48157: Formality - LFI

> Live exploitation tracking for CVE-2025-48157 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-48157

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.1
- **Public exploit available:** Yes
- **Affected products:** Michele Giorgi Formality
- **Weaknesses:** CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'))
- **Tags:** wordpress, cms

## Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through <= 1.5.9.

## CrowdSec analysis

[CVE-2025-48157](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-48157) is a local file inclusion (LFI) vulnerability in Michele Giorgi's Formality plugin up to version 1.5.9, caused by improper control of filenames in PHP include or require statements. This flaw allows remote attackers to include and potentially execute arbitrary files on the server, which could lead to information disclosure, code execution, or further compromise of the affected system.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of June 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-48157 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending crafted requests to endpoints such as `/wp-content/uploads/formality/storage/download.php` with parameters like `file=/etc/passwd` to include arbitrary local files, often following authentication via `/wp-login.php` and access to `/wp-admin/admin.php`.

## Timeline

- 2025-08-20: CVE Published. CVE-2025-48157 is published to NVD.
- 2026-06-03: Rule Released. CrowdSec releases a rule to detect CVE-2025-48157 exploitation attempts against the CrowdSec Network.
- 2026-06-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-48157 for the first time.

## References

- https://patchstack.com/database/Wordpress/Plugin/formality/vulnerability/wordpress-formality-1-5-9-local-file-inclusion-vulnerability?_s_id=cve
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48157.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-48157) follows observed exploitation activity for CVE-2025-48157. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.