The vulnerability arises from improper control of the filename used in an include/require statement within the Formality plugin. This flaw permits an attacker to cause the plugin to include arbitrary local files, potentially leading to the execution of attacker‑supplied PHP code or disclosure of confidential files. The weakness corresponds to CWE‑98, which represents a lack of validation on file names during inclusion operations. The result is a compromise of confidentiality, integrity, and possibly availability of the affected WordPress site.

The Formality plugin, developed by Michele Giorgi, is vulnerable in all released versions up to and including 1.5.7. WordPress sites that have installed an affected version of this plugin are at risk. No other vendors or product versions are listed as affected.

The CVSS score of 8.1 classifies this flaw as high severity. The EPSS score of less than 1 percent indicates that, as of the current analysis, the likelihood of an exploitation attempt is very low, and it is not listed in the CISA KEV catalog. However, the attack vector is likely remote, via an exposed form or input that triggers the inclusion logic. An attacker could supply a crafted file path through the form interface to gain access to local files or execute code. While the probability of exploitation remains small, the potential impact warrants prompt remediation.