{"id":"CVE-2014-125133","kind":"vulnerability","aliases":["CVE-2014-125133"],"related":[],"title":"NativeChurch WordPress theme: path traversal lets anyone download wp-config.php","description":"NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","summary":"The NativeChurch theme for WordPress before 1.6.2 has a path traversal flaw in download.php's file parameter. An unauthenticated attacker can send GET requests with directory traversal sequences to read arbitrary files, including wp-config.php, which holds database credentials.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nativechurch-theme","package","wordpress"],"not_affected_if":["theme-not-installed","version-1.6.2-or-later"],"how_to_check":"Check the installed theme version in wp-content/themes/ (style.css header or theme settings) and confirm whether download.php exists in the theme directory.","fix":"Update the NativeChurch theme to 1.6.2 or later; if no update is available, remove download.php or the theme. Rotate database credentials and salts if exposure is suspected.","status":"open","published_at":"2026-10-20T21:17:12+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:37:19+00:00","updated_at":"2026-10-23T22:37:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:37:19Z","model":"claude-haiku-5-5","output":{"fix":"Update the NativeChurch theme to 1.6.2 or later; if no update is available, remove download.php or the theme. Rotate database credentials and salts if exposure is suspected.","reach":"internet","title":"NativeChurch WordPress theme: path traversal lets anyone download wp-config.php","impact":"high","summary":"The NativeChurch theme for WordPress before 1.6.2 has a path traversal flaw in download.php's file parameter. An unauthenticated attacker can send GET requests with directory traversal sequences to read arbitrary files, including wp-config.php, which holds database credentials.","category":"package","who_cares":["wordpress","nativechurch-theme"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker downloads wp-config.php and reads database credentials","analyst_note":"Confirm the fixed version and whether the vendor patched or abandoned the theme; sources give no fix link beyond NVD.","how_to_check":"Check the installed theme version in wp-content/themes/ (style.css header or theme settings) and confirm whether download.php exists in the theme directory.","needs_analyst":true,"not_affected_if":["theme-not-installed","version-1.6.2-or-later"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000524,"input_tokens":2956,"output_tokens":457,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-10':114C '-125133':12A,15A '-19':115C '-2014':11A,14A '1.6.2':27B,64C '2023':113C 'allow':71C 'anyon':7A 'arbitrari':51B,76C 'attack':40B,73C,84C 'contain':65C 'credenti':58B 'cve':10A,13A 'databas':57B 'directori':46B,90C 'download':8A,75C 'download.php':34B,83C 'evid':104C 'exploit':103C 'file':36B,52B,77C,80C,95C,100C 'first':106C 'flaw':32B 'foundat':111C 'get':43B,87C 'hold':56B 'includ':53B 'let':6A 'like':101C 'nativechurch':1A,17B,22B,59C 'nativechurch-them':16B 'observ':107C 'packag':19B 'paramet':37B,81C,96C 'path':4A,30B,67C 'read':50B 'request':44B,88C 'retriev':98C 'send':42B,86C 'sensit':99C 'sequenc':48B,92C 'shadowserv':110C 'theme':3A,18B,23B,60C 'travers':5A,31B,47B,68C,91C 'unauthent':39B,72C 'vulner':69C 'wordpress':2A,20B,25B,62C 'wp-config.php':9A,54B,102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2014-125133","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-125133","severity":null,"published_at":"2026-10-20T21:17:12+00:00","modified_at":"2026-10-23T16:16:50+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}