High severity7.5NVD Advisory· Published Oct 20, 2026
CVE-2014-125133
CVE-2014-125133
Description
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.6.2
Patches
Vulnerability mechanics
References
6- github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/nativechurch-wp-theme-lfd.yamlnvd
- imithemes.com/item/native-church/nvd
- packetstorm.news/files/id/128101/nvd
- packetstorm.news/files/id/132297/nvd
- wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1nvd
- www.vulncheck.com/advisories/nativechurch-wordpress-theme-1.6.2-arbitrary-file-download-via-download-phpnvd
News mentions
0No linked articles in our index yet.