Live › vulnerability › CVE-2014-125134
Go to dashboardThe ChurcHope theme for WordPress before 2.2 has a path traversal flaw in its downloadlink.php file parameter. An unauthenticated attacker can read arbitrary server files such as wp-config.php, exposing database credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check whether the theme folder wp-content/themes/churchope/lib/downloadlink.php exists and read the installed theme version in its style.css.
Update the ChurcHope theme to version 2.2 or later, or remove the theme; rotate database credentials if the old version was exposed.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
This page as .md · .json · in your agent: get_signal("CVE-2014-125134")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.