CVE-2025-52745: 
WordPress vulnerability analysis and mitigation

CVE-2025-52745 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Farm Agrico WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement). It affects all versions of the Farm Agrico theme up to and including 1.3.11, and was discovered by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, reported on August 5, 2025, and published on September 4, 2025. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable by unauthenticated remote attackers with high attack complexity (Patchstack).

The vulnerability stems from improper control of filenames used in PHP include/require statements within the Farm Agrico WordPress theme (CWE-98), which allows an attacker to manipulate file path parameters to include arbitrary local files from the server. The attack vector is network-based, requires no authentication or user interaction, but does carry high attack complexity, suggesting some precondition or non-trivial exploitation path must be met. Exploitation enables reading of local server files by passing crafted input to vulnerable file inclusion logic in the theme. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation of this LFI vulnerability could allow an unauthenticated attacker to read sensitive files on the web server, including configuration files containing database credentials, WordPress wp-config.php, or other secrets, potentially leading to full database compromise or further system access. In certain server configurations, LFI vulnerabilities can be chained with log poisoning or other techniques to achieve remote code execution, escalating the impact to complete system compromise. The confidentiality, integrity, and availability impacts are all rated High in the CVSS scoring (Patchstack).

There is currently no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation for CVE-2025-52745. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently targeted in mass-exploit campaigns against WordPress sites (Patchstack).

As of the time of disclosure, no official patch from AncoraThemes has been released for the Farm Agrico theme beyond version 1.3.11. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is available. Recommended actions include: (1) Update the Farm Agrico theme to any version beyond 1.3.11 if/when released; (2) Apply Patchstack's virtual patch as an interim measure; (3) Implement strict server-side input validation for file inclusion parameters; (4) Use allow-lists for permitted file paths; (5) Apply the principle of least privilege to the web server process (Patchstack).