CVE-2014-125133

Deferred Deferred - Pending Action

NativeChurch WordPress Theme Path Traversal Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: VulnCheck

Description

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2014-125133

Affected Vendors & Products

Vendor	Product	Version / Range
imithemes	NativeChurch	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the NativeChurch WordPress theme before version 1.6.2. It allows unauthenticated attackers to download arbitrary files by manipulating the file parameter in download.php. Attackers can use directory traversal sequences to access sensitive files like wp-config.php.

Detection Guidance

Check if the NativeChurch WordPress theme version is below 1.6.2. Look for unusual GET requests to download.php with path traversal sequences like ../ in the file parameter. Monitor logs for requests accessing sensitive files such as wp-config.php.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files on your server, including configuration files that may contain database credentials or other confidential information. Attackers could exploit this to steal data, gain further access to your system, or compromise your WordPress installation.

Compliance Impact

This vulnerability allows unauthenticated attackers to access sensitive files like wp-config.php, which may contain database credentials and other confidential information. Exposure of such data could lead to violations of GDPR (if personal data is exposed) and HIPAA (if protected health information is compromised), depending on the nature of the exposed files.

Mitigation Strategies

Update the NativeChurch theme to version 1.6.2 or later immediately. Remove or restrict access to download.php if not needed. Implement web application firewall rules to block requests with path traversal patterns in the file parameter.

Hi! I’m here to help you understand CVE-2014-125133. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...