A critical local file inclusion vulnerability in the AncoraThemes Farm Agrico theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

This vulnerability is a Local File Inclusion (CWE-98) flaw where an unauthenticated attacker can manipulate filename parameters to include unauthorized files, leading to high confidentiality, integrity, and availability impact.

Successful exploitation allows an attacker to access sensitive configuration files or execute arbitrary code, which could lead to a full compromise of the underlying WordPress installation. Given the CVSS score of 8.1, this represents a high-risk security event that could result in data exfiltration or complete loss of system control.

Immediate Action: Since no specific patch version is confirmed, users should immediately disable or remove the Agrico theme if it is not business-critical, or contact the vendor for an emergency security update.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file inclusions targeting PHP scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized PHP include requests.

Public Exploit Available: No (exploit_available: false)

The severity of this Local File Inclusion vulnerability necessitates immediate attention from administrators responsible for environments using the Agrico theme. Because the vulnerability is unauthenticated, it poses a direct risk to public-facing systems. We recommend auditing all WordPress installations for the presence of this theme and applying the strictest access controls until a confirmed vendor patch is released and verified.