CVE-2025-63036
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows PHP Local File Inclusion.This issue affects Ronneby Theme Core: from n/a through <= 1.5.68.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe Ronneby Theme Core plugin for WordPress contains a Local File Inclusion (LFI) vulnerability allowing attackers to manipulate PHP include/require statements to read arbitrary files on the server filesystem. This can expose sensitive configuration files, credentials, and source code.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- High
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify if Ronneby theme is installedCheck your WordPress themes directory (wp-content/themes/) for a folder named 'ronneby' or 'dfd-ronneby'. Use FTP, file manager, or run: ls wp-content/themes/ | grep -i ronnebyAffected if The ronneby theme folder exists in your WordPress installation
-
Find the installed Ronneby theme versionOpen the style.css file inside the theme folder (wp-content/themes/ronneby/style.css) and look for the 'Version:' header in the file comments. Alternatively, check the theme's main functions.php file for a version constantAffected if The version number found is lower than 1.5.69 or cannot be determined (missing version info may indicate a modified or outdated installation)
-
Check for the Core plugin componentLook for a 'core' folder or plugin subdirectory within the theme (wp-content/themes/ronneby/core/). The vulnerability exists in the theme core functionality, not just the theme itselfAffected if The core folder exists and contains PHP files that handle file inclusion operations
-
Inspect HTTP request parameters for LFI patternsReview your web server access logs for requests to pages using the Ronneby theme. Search for traversal patterns such as '../', '..\', or include/require parameters in URLs. Example grep: grep -E '\.\./|\.\.\\' /var/log/apache2/access.log | grep -i ronnebyAffected if Requests contain directory traversal sequences targeting the theme's PHP files
-
Verify sensitive file exposureTest if arbitrary file reading is possible by attempting to access a known file through theme endpoints. Check if files like wp-config.php are accessible via theme URL parameters (this is a verification test only, not exploitation)Affected if The application returns contents of files outside the web root via theme parameters
You are affected if the Ronneby theme is installed with a version lower than 1.5.69 and the theme's core functionality handles file inclusion operations without proper sanitization.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataUpdate Ronneby Theme Core to version 1.5.69 or later to obtain the vendor patch. If immediate patching is not possible, disable the theme and implement Web Application Firewall rules to block directory traversal patterns in HTTP requests.
- Consultation2.0 h
- Implementation2.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-63036 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-63036 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data