The vulnerability in Michele Giorgi Formality arises from improper handling of filenames in a PHP include/require statement, enabling Local File Inclusion. An attacker who can influence the include path can read arbitrary files on the server, potentially executing sensitive code or retrieving confidential data. The weakness is classified as CWE-98, representing a lack of validation on include paths.

The issue affects the Formality WordPress plugin by Michele Giorgi, specifically all releases up to and including version 1.5.9. Users running any of those versions are vulnerable.

With a CVSS score of 8.1, the vulnerability is considered high severity. The EPSS score of 5% indicates a low probability of widespread exploitation at this time. Since the vulnerability involves local file inclusion, an attacker would typically need some form of input that reaches the plugin code, such as a crafted query string or form field. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Nevertheless, the potential to read arbitrary files or execute code makes this a significant risk for any WordPress site using the affected plugin.