What is the CVSS score of CVE-2025-48330?

CVE-2025-48330 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Real Time Validation for Gravity Forms are affected by CVE-2025-48330?

The Real Time Validation for Gravity Forms plugin (versions ≤1.7.0) contains a local file inclusion vulnerability that could allow attackers to access sensitive files including configuration data and…

How to fix or mitigate CVE-2025-48330?

Within 24 hours: audit all WordPress installations for Real Time Validation for Gravity Forms and document current versions in use. Within 7 days: disable the plugin if version ≤1.7.0 is identified and no patch is available, or migrate to a supported alternative form validation solution. Within 30 days: establish a monitoring process for vendor security advisories from Patchstack and implement a formal plugin lifecycle management policy requiring quarterly version audits.

Real Time Validation for Gravity Forms CVE-2025-48330

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:00 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.8 (CRITICAL) 7.5 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows PHP Local File Inclusion.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.

AnalysisAI

Local file inclusion in Real Time Validation for Gravity Forms WordPress plugin (versions ≤1.7.0) enables remote attackers to read arbitrary files from the web server, potentially exposing sensitive configuration data, credentials, and source code. Despite the 7.5 CVSS score, real-world risk is moderate: the attack requires high complexity and user interaction (CVSS:AV:N/AC:H/UI:R), and EPSS probability is low at 0.14% (35th percentile). Patchstack vulnerability database confirms the flaw but no CISA KEV listing or public POC has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98). The plugin, which provides real-time form validation for the Gravity Forms WordPress plugin, fails to sanitize user-controlled input used to construct file paths before passing them to PHP file inclusion functions. While classified as 'PHP Remote File Inclusion' in the description, available intelligence confirms this as Local File Inclusion (LFI) - an attacker can traverse the filesystem to read local files but not directly include remote PHP code from external servers. The flaw exists in the interaction between WordPress's plugin architecture and Gravity Forms' validation hooks, where user-supplied parameters reach include/require statements without proper path normalization or whitelist validation. This is a common vulnerability class in WordPress plugins that dynamically load files based on request parameters.

Affected ProductsAI

The vulnerability affects the Real Time Validation for Gravity Forms WordPress plugin, specifically all versions from initial release through version 1.7.0 inclusive. This is a third-party WordPress plugin developed by Daman Jeet that extends the commercial Gravity Forms plugin with client-side validation capabilities. Affected deployments require both WordPress core, the Gravity Forms premium plugin, and this specific validation extension to be vulnerable. The Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/real-time-validation-for-gravity-forms/vulnerability/wordpress-real-time-validation-for-gravity-forms-1-7-0-local-file-inclusion-vulnerability provides additional technical details. No CPE identifier was provided in available data sources.

RemediationAI

Immediately upgrade Real Time Validation for Gravity Forms to version 1.7.1 or later if available through the WordPress plugin repository. Check the plugin's official page or Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/real-time-validation-for-gravity-forms/vulnerability/wordpress-real-time-validation-for-gravity-forms-1-7-0-local-file-inclusion-vulnerability for confirmed patched versions. If no patched version exists, disable and remove the Real Time Validation for Gravity Forms plugin entirely until a fix is released - this will remove real-time validation features but eliminates the attack surface. As a temporary compensating control, restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules, reducing the likelihood of attackers triggering the user-interaction-required exploit chain. Note that generic web application firewalls may not effectively block LFI attempts using path traversal sequences, so disabling the plugin is the most reliable mitigation. Monitor WordPress access logs for suspicious requests containing '../' sequences or attempts to access sensitive files like wp-config.php.