CVE-2025-63036: 
WordPress vulnerability analysis and mitigation

CVE-2025-63036 is a PHP Local File Inclusion (LFI) vulnerability in the DFDevelopment Ronneby Theme Core WordPress plugin (ronneby-core), classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the plugin through 1.5.68 and was published on December 9, 2025, with Patchstack credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Patchstack).

The root cause is improper sanitization and validation of user-supplied input used in PHP include/require statements within the Ronneby Theme Core plugin (CWE-98). An authenticated attacker with low privileges can manipulate filename parameters to cause the PHP interpreter to include arbitrary local files from the server's filesystem. This attack vector is network-based and requires no user interaction, though it does require low-level authentication and has high attack complexity. No public proof-of-concept code has been identified at this time (Feedly).

Successful exploitation allows an attacker to read arbitrary files from the server's filesystem, potentially exposing sensitive configuration files (e.g., wp-config.php containing database credentials), private keys, or other confidential data. The CVSS scoring reflects high impacts to confidentiality, integrity, and availability, indicating that under certain conditions exploitation could extend beyond file disclosure to code execution. WordPress sites running the affected plugin are at risk of full compromise if an attacker can chain this LFI with other vulnerabilities (Feedly).

No known active in-the-wild exploitation or weaponized exploit kits have been reported for CVE-2025-63036 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053% (0.000530), indicating a low probability of exploitation in the near term. Exploitation requires low-privilege authentication and high attack complexity, which somewhat limits opportunistic abuse (Feedly).

1. Reconnaissance: Identify WordPress sites running the Ronneby Theme Core plugin (ronneby-core) version 1.5.68 or earlier using tools like WPScan or Shodan with WordPress fingerprinting.
2. Authentication: Obtain low-privilege credentials (e.g., subscriber or contributor account) on the target WordPress site, potentially via credential stuffing or registration if open.
3. Identify vulnerable parameter: Locate the plugin functionality that accepts a filename or path parameter passed to a PHP include/require statement — typically found in shortcodes, AJAX handlers, or template loading functions.
4. Craft LFI payload: Submit a crafted request with a manipulated filename parameter pointing to a sensitive local file, such as ../../../../wp-config.php or /etc/passwd, using path traversal sequences.
5. Extract sensitive data: Review the server response for the contents of the included file, extracting credentials, API keys, or other sensitive configuration data for further exploitation or lateral movement (Feedly).

• Network: Unusual authenticated HTTP requests to WordPress endpoints associated with the ronneby-core plugin containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameter values.
• Logs: WordPress or web server access logs showing requests with encoded path traversal strings targeting plugin-related endpoints; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or SSL private key files that correlate with suspicious request times.
• Process: PHP error logs showing include() or require() failures for unusual file paths, which may indicate failed LFI attempts.

Users should update the Ronneby Theme Core plugin (ronneby-core) to a version beyond 1.5.68 as soon as a patched release is made available by DFDevelopment. In the interim, site administrators should consider deactivating the plugin if it is not critical to site operation, or restricting access to WordPress admin and authenticated areas using IP allowlisting. Implementing a Web Application Firewall (WAF) with rules to detect and block path traversal patterns can provide additional protection (Patchstack).