PHP Remote File Inclusion Vulnerability in Daman Jeet Real Time Validation for Gravity Forms
CVE-2025-48330

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Real Time Validation For Gravity Forms
Vendor
CVE Published:
6 November 2025

What is CVE-2025-48330?

The Daman Jeet Real Time Validation for Gravity Forms plugin is susceptible to a PHP remote file inclusion vulnerability, which enables attackers to manipulate file paths for inclusion. This flaw allows unauthorized access to local files on the server, potentially leading to the execution of malicious scripts. The issue affects versions up to and including 1.7.0, making it imperative for users to upgrade to mitigate the risks associated with local file inclusion.

Affected Version(s)

Real Time Validation for Gravity Forms <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/real...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien | Patchstack Bug Bounty Program
JSON
.