Agricola
Monthly
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.