ChurcHope WordPress Theme: Path traversal allows reading arbitrary files
Summary
The ChurcHope theme for WordPress before version 2.2 contains a path traversal flaw in the file parameter of /wp-content/themes/churchope/lib/downloadlink.php. An unauthenticated remote attacker can use directory traversal sequences to download arbitrary files from the web server, for example wp-config.php, which can expose database credentials. Public scanner templates exist, and the Shadowserver Foundation reportedly observed exploitation attempts; the exploitation status is contradictory across sources.
Affected
- ChurcHope WordPress theme versions before 2.2 (affected range 0 to < 2.2 per CNA record; WPScan lists <= 2.1)
- Note: VulDB describes the product as a plugin; other sources describe it as a theme.
Fixed in
- Version 2.2 (per all sources; no vendor advisory or changelog found to confirm it)
Workaround
- No vendor-documented workaround.
- Generic option (untested for this theme): remove the theme and its lib/downloadlink.php file.
- Generic option (untested for this theme): restrict web access to /lib/downloadlink.php at the web server or WAF.
Exploitation
- Official CNA record (SSVC): exploitation status 'poc', automatable: yes, technical impact: partial.
- Shadowserver reportedly first observed exploitation on 2023-10-18 (date predates the 2026 publication; unexplained).
- A VulnCheck KEV listing is reported by one aggregator but could not be verified; no CISA KEV entry found.
- A public Nuclei detection template exists; Packet Storm lists an entry (content not reviewed). VulDB states no exploit exists.
Our recommendation
- Update the ChurcHope theme to version 2.2 or later, or remove the theme if it is not needed.
- If patching is not possible, block access to downloadlink.php at the web server or WAF.
- Check web server logs for requests to downloadlink.php containing '../' sequences.
- If the theme was exposed, assume wp-config.php may have been read: rotate database credentials and review the site.
- Verify the fixed version against the ThemeForest item page, as no vendor advisory was found.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Nuclei template churchope-lfi.yaml github.com
- WPScan vulnerability entry wpscan.com
- VulnCheck advisory www.vulncheck.com
- OpenCVE CVE-2014-125134 app.opencve.io
- VulDB 423012 vuldb.com
- Vulners NVD:CVE-2014-125134 vulners.com
- Exploit-Intel CVE-2014-125134 exploit-intel.com
- Packet Storm files 129706 packetstorm.news
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:26.
Original description (NVD)
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
NVD references (5)
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/churchope-lfi.y…
- https://packetstorm.news/files/id/129706/
- https://web.archive.org/web/20220629224817/https://www.cloudways.com/en/best-wordpress-themes/nonprofit/church
- https://wpscan.com/vulnerability/3c5833bd-1fe0-4eba-97aa-7d3a0c8fda15
- https://www.vulncheck.com/advisories/churchope-wordpress-theme-2.2-path-traversal-via-downloadlink-php
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.