CVE-2014-125133 in NativeChurch Plugin
Summary
by MITRE • 10/21/2026
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The NativeChurch WordPress theme, prior to version 1.6.2, contains a critical path traversal vulnerability within its file download functionality. This flaw resides in the download.php script, which is designed to facilitate the retrieval of specific files associated with the theme or site content. However, due to insufficient input validation and sanitization of the user-supplied file parameter, the application fails to properly restrict access to only intended resources. An unauthenticated attacker can exploit this weakness by crafting a malicious HTTP GET request that includes directory traversal sequences, such as ../..//, within the file parameter value. This manipulation allows the attacker to break out of the expected directory context and traverse up the server's filesystem hierarchy to access arbitrary files located outside the web root or in sensitive directories where configuration data is stored.
The operational impact of this vulnerability is severe, primarily because it enables unauthorized information disclosure without requiring any form of authentication. By leveraging this path traversal flaw, an attacker can retrieve highly sensitive configuration files from the WordPress installation directory. The most critical target for such exploitation is typically wp-config.php, which contains database credentials, secret keys, and other security salts essential for the integrity and confidentiality of the entire website. Access to these credentials allows attackers to gain direct access to the underlying database, potentially leading to data theft, defacement, or further compromise of the hosting environment. Additionally, exposure of other configuration files may reveal server paths, plugin details, or internal network structures that can be used for subsequent attacks.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file names or pathnames that could cause the system to access files in unintended locations. From an offensive security perspective, this exploitation technique is categorized under MITRE ATT&CK Technique T1083: File and Directory Discovery, as it involves enumerating and accessing sensitive files on a compromised host. The practical significance of this flaw was underscored by observations from the Shadowserver Foundation on October 19, 2023, which documented active exploitation attempts in the wild, indicating that automated scanners or threat actors are actively targeting sites running vulnerable versions of the NativeChurch theme.
To mitigate this risk, site administrators must immediately upgrade the NativeChurch WordPress theme to version 1.6.2 or later, where the path traversal issue has been resolved through proper input validation and secure file handling practices. Until an update is applied, temporary mitigations include restricting access to the download.php script via web server configuration rules if it is not required for public-facing functionality, or implementing a Web Application Firewall rule that blocks requests containing directory traversal sequences in query parameters. Regular security audits and monitoring of server logs for unusual GET requests targeting sensitive file paths can also help detect exploitation attempts early. Maintaining up-to-date software components remains the most effective defense against such known vulnerabilities.