What is the CVSS score of CVE-2025-69177?

CVE-2025-69177 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Roneous WordPress Theme are affected by CVE-2025-69177?

The Roneous WordPress theme (versions up to 2.1.5) contains a critical vulnerability allowing unauthenticated attackers to read sensitive server files, including database credentials stored in…

How to fix or mitigate CVE-2025-69177?

Within 24 hours: Audit all WordPress installations for Roneous theme presence and disable the theme if not actively in use. Within 7 days: Upgrade Roneous to a version beyond 2.1.5 if the theme is required, or replace with a maintained alternative theme from the official WordPress repository. Within 30 days: Review server access logs for evidence of exploitation attempts and audit WordPress user accounts and database credentials for unauthorized access or modification.

Roneous WordPress Theme CVE-2025-69177

EUVD-2025-210183 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Roneous

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable, unauthenticated LFI with no UI; AC:H reflects filter-bypass / path-knowledge needs; C:H for wp-config disclosure, but I/A only L without a confirmed RCE chain.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:48 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.

AnalysisAI

Unauthenticated local file inclusion in the Roneous WordPress theme (versions up to and including 2.1.5) allows remote attackers to coerce the application into including arbitrary files on the server, potentially exposing sensitive data such as wp-config.php credentials or, when combined with file upload primitives, achieving remote code execution. The flaw is reachable without authentication over the network, and no public exploit identified at time of analysis. The vulnerability is tracked by Patchstack and ENISA EUVD (EUVD-2025-210183).

Technical ContextAI

Roneous is a commercial WordPress theme distributed by ThemeLogi, identified by CPE cpe:2.3:a:themelogi:roneous. The weakness is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), meaning a PHP include()/require() construct in the theme accepts attacker-controlled input as a filename without adequate validation or path normalization. In the WordPress theme context, such sinks are typically located in AJAX handlers, template loaders, or front-end controllers that dispatch on a 'page', 'view', 'template', or similar request parameter, allowing path traversal sequences or absolute paths to be passed straight into the include statement.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory marks the affected range as 'n/a ≤ 2.1.5' with no fixed version cited, so administrators should monitor https://patchstack.com/database/wordpress/theme/roneous/vulnerability/wordpress-roneous-theme-2-1-5-local-file-inclusion-vulnerability and the ThemeLogi vendor changelog for a release beyond 2.1.5 and upgrade as soon as one is published. As compensating controls until a fix exists, deploy a WAF rule (e.g. Patchstack's mu-plugin, Wordfence, or ModSecurity CRS rules 930100/930110) to block path-traversal sequences such as '../', null bytes, and 'php://' / 'file://' wrappers on theme endpoints; restrict open_basedir and disable allow_url_include in php.ini to contain the include sink (side effect: may break legitimate plugins that rely on stream wrappers); and if the site does not depend on theme front-end features such as AJAX template loaders, temporarily switching to a different theme or hardening file permissions on wp-config.php (chmod 400) reduces the blast radius at the cost of feature loss.