The vulnerability is an improper control of the filename used in PHP include/require statements within the Agricola theme. An attacker can supply an arbitrary file path, enabling local file inclusion. This can expose sensitive files such as configuration or credentials, and may serve as a foothold for further exploitation. The issue carries a CVSS score of 8.1, indicating a high risk to confidentiality and integrity.

WordPress installations that use the Agricola theme by axiomthemes, with versions from the first release up through and including 1.1.0. These versions contain the vulnerable file‑inclusion logic that can be triggered by user input.

The EPSS score is reported as less than 1%, indicating that the likelihood of immediate exploitation appears modest, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the high CVSS score and the nature of the local file inclusion indicate that a web‑based attacker could craft requests to the theme that supply a malicious filename, potentially reading arbitrary files on the server. No additional exploitation prerequisites are described, so the attack vector is likely straightforward for an attacker with access to the affected web application.