A critical local file inclusion vulnerability in the axiomthemes Agricola theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

This vulnerability is a Local File Inclusion (LFI) flaw, categorized as CWE-98, which occurs when user-supplied input is insufficiently validated before being used in a PHP include or require statement. An unauthenticated attacker can manipulate these parameters to access or process unauthorized files on the web server.

The exploitation of this flaw poses a severe risk to organizational security, as it can lead to the exposure of sensitive configuration files, database credentials, or source code. Given the CVSS score of 8.2, this vulnerability is classified as High severity, representing a significant risk of full system compromise and unauthorized data access if left unpatched.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official Patchstack vulnerability database and the vendor website for the release of an updated theme version. If no update is available, consider switching to an alternative, supported theme.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or requests for sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and requests containing malicious include parameters.

Public Exploit Available: Unknown.

Given the potential for complete system compromise via unauthorized file access, administrators must prioritize the remediation of this vulnerability. Organizations using the Agricola theme should audit their web environment for the presence of the affected versions and implement strict WAF filtering until a vendor-supplied security update is confirmed and applied.