ChurcHope vulnerabilities

🔔 Create alert RSS

Published CVEs affecting ChurcHope products: 1 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2014-125134 High · 7.5 CWE-22 Oct 20, 2026

ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php

ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.