漏洞描述
Michele Giorgi Formality <= 1.5.9 contains a file inclusion vulnerability caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires crafted input.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/formality/formality-159-unauthenticated-local-file-inclusion↗plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3277800%40formality&old=3248498%40formality↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2025-48157↗