Live › vulnerability › CVE-2014-125133
Go to dashboardThe NativeChurch theme for WordPress before 1.6.2 has a path traversal flaw in download.php's file parameter. An unauthenticated attacker can send GET requests with directory traversal sequences to read arbitrary files, including wp-config.php, which holds database credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed theme version in wp-content/themes/ (style.css header or theme settings) and confirm whether download.php exists in the theme directory.
1.6.2 or later; if no update is available, remove download.php or the themeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
This page as .md · .json · in your agent: get_signal("CVE-2014-125133")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.