What’s Vulnerable › Vulnerabilities

CVE-2014-125133: NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-23
• Weakness: CWE-22

Description

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Affected products

• imithemes NativeChurch: before 1.6.2 — fixed in 1.6.2

How to fix

Upgrade to a fixed version: imithemes NativeChurch 1.6.2. Check the vendor advisory for mitigations.

References

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/nativechurch-wp-theme-lfd.yaml
• https://imithemes.com/item/native-church/
• https://packetstorm.news/files/id/128101/
• https://packetstorm.news/files/id/132297/
• https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1
• https://www.vulncheck.com/advisories/nativechurch-wordpress-theme-1.6.2-arbitrary-file-download-via-download-php
• https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1

Get alerted when CVE-2014-125133 or the next vulnerability affects your stack