The vulnerability CVE-2025-48330 affects the Real Time Validation for Gravity Forms plugin by Daman Jeet. It arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include arbitrary files on the server, potentially leading to remote code execution or data disclosure. The issue affects all versions up to 1.7.0. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, which may lead to disclosure of sensitive information, execution of arbitrary code, and full compromise of the affected system's confidentiality, integrity, and availability. The CVSS score of 7.5 indicates a high impact. However, no known exploits are reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or removing the affected plugin if feasible, or applying any recommended temporary mitigations from the vendor. Avoid exposing the affected service to untrusted networks and limit user interaction where possible.