Path Traversal Vulnerability in NativeChurch Theme for WordPress
CVE-2014-125133

8.7HIGH

Key Information:

Vendor: WordPress
Status: Nativechurch
Vendor: CVE Published:; 20 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2014-125133?

The NativeChurch theme for WordPress versions before 1.6.2 suffers from a path traversal vulnerability, enabling unauthenticated attackers to exploit the download.php file. By manipulating the file parameter with directory traversal sequences, attackers can potentially access and download sensitive files from the server, such as wp-config.php. This vulnerability poses a significant threat to WordPress installations using this theme, as it may lead to unauthorized access to sensitive information.

Affected Version(s)

NativeChurch 0 < 1.6.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2014-125133 - Proof of Concept