Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Farm Agrico farmagrico allows PHP Local File Inclusion.This issue affects Farm Agrico: from n/a through <= 1.3.11.
Published: 2025-12-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from an improper control of the filename used in PHP include/require statements within the AncoraThemes Farm Agrico WordPress theme. The flaw allows arbitrary local files to be loaded through PHP's include/require mechanism, potentially exposing the contents of files on the server.

Affected Systems

All WordPress sites that employ the AncoraThemes Farm Agrico theme version 1.3.11 or earlier are affected. The insecure include logic is present in every deployment of the theme, regardless of WordPress version or hosting environment.

Risk and Exploitability

With a CVSS score of 8.1, the flaw is classified as high severity. The EPSS score of less than 1% indicates that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on April 29, 2026 at 22:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Farm Agrico theme to a version newer than 1.3.11.
  • If an immediate upgrade is not possible, modify the theme code to remove or sanitize any dynamic include calls, using a strict whitelist of permissible files.
  • Disable the PHP directives allow_url_fopen and allow_url_include in the server or php.ini configuration to prevent remote and local resource inclusion exploits.

Generated by OpenCVE AI on April 29, 2026 at 22:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Fri, 19 Dec 2025 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 18 Dec 2025 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 18 Dec 2025 07:45:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Farm Agrico farmagrico allows PHP Local File Inclusion.This issue affects Farm Agrico: from n/a through <= 1.3.11.
Title WordPress Farm Agrico theme <= 1.3.11 - Local File Inclusion vulnerability
Weaknesses CWE-98
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T19:03:47.026Z

Reserved: 2025-06-19T10:02:47.063Z

Link: CVE-2025-52745

cve-icon Vulnrichment

Updated: 2025-12-18T19:19:21.366Z

cve-icon NVD

Status : Deferred

Published: 2025-12-18T08:15:52.750

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-52745

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T22:45:06Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')