CVE-2025-52745 affects AncoraThemes Farm Agrico up to version 1.3.11 and is caused by improper control of filenames used in PHP include or require statements. This vulnerability allows local file inclusion (LFI), enabling an attacker to include and execute files on the server. The CVSS 3.1 score of 8.1 reflects a high-severity remote vulnerability with significant impact on confidentiality, integrity, and availability. There is no information about an official patch or vendor advisory, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow an attacker to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS vector indicates a network attack vector with high complexity and no privileges or user interaction required, resulting in high impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable include/require functionality or applying other PHP hardening measures specific to file inclusion. Monitor official AncoraThemes communications for updates and patches.