NativeChurch WordPress theme: Path traversal allows arbitrary file download

Summary

The NativeChurch theme for WordPress before version 1.6.2 contains a path traversal flaw in the file parameter of download.php. An unauthenticated attacker can send crafted GET requests to download arbitrary files from the server, such as wp-config.php, which contains database credentials. No login or user interaction is required. Exploitation evidence exists, and public detection templates are available.

Affected

• NativeChurch theme (imithemes), versions before 1.6.2
• The vendor's current version number (4.9.5) differs from the 1.6.2 numbering in the CVE record. Verify the installed version from the theme files or the vendor changelog.

Fixed in

• Version 1.6.2 or later

Workaround

• No vendor workaround known.
• If the theme is unused, deactivate and remove it.
• If it must stay, restrict web-server access to download.php and keep wp-config.php out of reach as far as possible.
• If exposure is suspected, rotate database credentials and salts.

Exploitation

• Exploitation evidence first observed by the Shadowserver Foundation on 2023-10-19.
• CISA SSVC assessment: exploitation status poc, automatable: yes, technical impact: partial.
• A public Nuclei detection template exists.
• One aggregator lists the flaw as observed in the VulnCheck KEV catalogue, while another source does not list it as known exploited. CISA KEV status not verified.

Our recommendation

• Check whether any WordPress site uses the NativeChurch theme and confirm its version.
• Update to version 1.6.2 or later.
• Review web logs for requests to download.php containing traversal sequences such as ../.
• If such requests are found, treat the site as compromised: rotate credentials and review the site.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Nuclei template nativechurch-wp-theme-lfd (GitHub) github.com
• Native Church theme page (imithemes) imithemes.com
• VulnCheck advisory: NativeChurch arbitrary file download www.vulncheck.com
• WPScan vulnerability entry wpscan.com
• WPScan theme NativeChurch wpscan.com
• OpenCVE CVE-2014-125133 app.opencve.io
• VulDB entry 423011 vuldb.com
• Exploit-Intel CVE-2014-125133 exploit-intel.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:26.