---
id: "CVE-2014-125133"
kind: "vulnerability"
aliases: ["CVE-2014-125133"]
title: "NativeChurch WordPress theme: path traversal lets anyone download wp-config.php"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nativechurch-theme", "package", "wordpress"]
not_affected_if: ["theme-not-installed", "version-1.6.2-or-later"]
published_at: "2026-10-20T21:17:12+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T22:37:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-125133", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# NativeChurch WordPress theme: path traversal lets anyone download wp-config.php

The NativeChurch theme for WordPress before 1.6.2 has a path traversal flaw in download.php's file parameter. An unauthenticated attacker can send GET requests with directory traversal sequences to read arbitrary files, including wp-config.php, which holds database credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed theme version in wp-content/themes/ (style.css header or theme settings) and confirm whether download.php exists in the theme directory.

## Fix

Update the NativeChurch theme to 1.6.2 or later; if no update is available, remove download.php or the theme. Rotate database credentials and salts if exposure is suspected.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2014-125133

## From the sources

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_