External risk intelligence

Agricola Theme PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-65579

Agricola is a WordPress theme. WordPress themes are commonly deployed as part of public-facing web applications. Because the vulnerability allows unauthenticated access to the theme's functionality via the web, it is likely to be reachable from the internet in standard deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the Agricola software, which could allow unauthorized access and manipulation of systems. This issue stems from an unauthenticated PHP object injection flaw, meaning an attacker could potentially exploit it without needing any credentials, posing a significant risk to system integrity and data.

Unauthenticated code injection in Agricola software.
Affects public-facing web applications.
Confirm relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to a web application using the Agricola theme. This could allow them to inject malicious PHP objects, potentially leading to full server compromise without needing any prior authentication or special access.

No authentication required.
Triggered via network requests.
Risk of complete server takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject arbitrary PHP objects into the Agricola theme. When supported by the advisory, this could lead to the execution of malicious code or unauthorized data manipulation.

Theme settings and data.
Via crafted user input.
Unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP Object Injection vulnerability in the Agricola theme could impact public-facing websites. The initial priority is to identify all instances of the affected theme, determine their exposure and business criticality, and locate the accountable application or platform owner. Once confirmed, a coordinated remediation plan can be developed based on the identified risk.

Theme owners should manage the issue.
Verify theme exposure and criticality.
Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Agricola software?

Agricola is a theme designed for WordPress, which is a widely used content management system. Themes like this define the visual appearance and layout of a website. Because they integrate directly into the WordPress environment, they often handle user requests and site data, making them an essential part of the web application's functionality.

What does PHP object injection mean for CVE-2026-65579?

This vulnerability relates to CWE-502, Deserialization of Untrusted Data. It means the Agricola theme improperly handles data provided by a user, allowing an attacker to insert malicious PHP objects into the application. If successful, the system may treat this crafted data as legitimate instructions, potentially allowing the attacker to manipulate data or execute unauthorized code on the server.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted network request to a website running the affected Agricola theme. Because the theme does not require authentication, the attacker does not need an account or special privileges to send this input. Simply viewing the site or interacting with standard, non-malicious features of the theme does not trigger the bug; it requires specifically prepared data designed to exploit the deserialization process.

Why should I be concerned about CVE-2026-65579?

According to Halo Surface Signal, Agricola is typically used in public-facing web applications. Because this vulnerability is reachable over the internet without authentication, your site is at higher risk if it is accessible to the public. If your instance is internet-facing, it is a primary target, as the attack can be launched remotely without any prior access to your system or infrastructure.

What should I do if I use the Agricola theme?

First, conduct an inventory to identify every instance of the Agricola theme within your environment. Verify whether these instances are exposed to the public internet and assess the criticality of the data they handle. Once you have identified the affected sites, coordinate with the relevant application owners to plan and prioritize the necessary security updates to mitigate the risk of unauthorized server access.

References

patchstack.com/database/wordpress/theme/agricola/vulnerability/wordp…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.