CVE-2014-125134 Details

A path traversal vulnerability has been identified in the ChurcHope theme for WordPress, affecting versions prior to 2.2. This vulnerability allows unauthenticated attackers to download arbitrary files by exploiting the 'file' parameter in '/wp-content/themes/churchope/lib/downloadlink.php'. The issue arises from inadequate validation of user-supplied input, enabling attackers to use directory traversal sequences to access sensitive files such as 'wp-config.php' or '/etc/passwd', thereby exposing critical database credentials. The first evidence of exploitation was observed by the Shadowserver Foundation on October 18, 2023.

Users are advised to update the ChurcHope theme to version 2.2 or later, where this vulnerability has been fixed.