blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2014-125133

HIGH 8.7 CVSS 4.0
Published
October 20, 2026
Last modified
October 23, 2026
NVD status
Deferred
Reported by
disclosure@vulncheck.com
Weakness
CWE-22
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Affected products and versions

  • imithemes NativeChurch — Before 1.6.2

References

  • github.com https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/nativechurch-wp-theme-lfd.yaml
  • imithemes.com https://imithemes.com/item/native-church/
  • packetstorm.news https://packetstorm.news/files/id/128101/
  • packetstorm.news https://packetstorm.news/files/id/132297/
  • wpscan.com https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1
  • www.vulncheck.com https://www.vulncheck.com/advisories/nativechurch-wordpress-theme-1.6.2-arbitrary-file-download-via-download-php
  • nvd.nist.gov Official NVD record