CVE-2014-125133

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/nativechurch-wp-theme-lfd.yaml
https://imithemes.com/item/native-church/
https://packetstorm.news/files/id/128101/
https://packetstorm.news/files/id/132297/
https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1
https://www.vulncheck.com/advisories/nativechurch-wordpress-theme-1.6.2-arbitrary-file-download-via-download-php
https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1

Configurations

No configuration.

History

23 Oct 2026, 16:16

Type	Values Removed	Values Added
References	~~() https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1 -~~	() https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1 -

20 Oct 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-20 21:17

Updated : 2026-10-23 16:16

NVD link : CVE-2014-125133

Mitre link : CVE-2014-125133

CVE.ORG link : CVE-2014-125133

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2014-125133", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2014-125133", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-23T15:23:37.473047Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "imithemes", "product": "NativeChurch", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.2", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-20T21:17:12.560", "references": [{"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/nativechurch-wp-theme-lfd.yaml", "source": "disclosure@vulncheck.com"}, {"url": "https://imithemes.com/item/native-church/", "source": "disclosure@vulncheck.com"}, {"url": "https://packetstorm.news/files/id/128101/", "source": "disclosure@vulncheck.com"}, {"url": "https://packetstorm.news/files/id/132297/", "source": "disclosure@vulncheck.com"}, {"url": "https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nativechurch-wordpress-theme-1.6.2-arbitrary-file-download-via-download-php", "source": "disclosure@vulncheck.com"}, {"url": "https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19."}], "lastModified": "2026-10-23T16:16:50.017", "sourceIdentifier": "disclosure@vulncheck.com"}