churchope
churchope is a WordPress theme with 1 published CVE record in this archive. The latest tracked vulnerability was published Oct 20, 2026; the highest published CVSS base score is 8.7.
churchopeCVE-2014-125134: ChurcHope: Unauthenticated arbitrary file read
An unauthenticated attacker can supply a traversal path through the file parameter to /wp-content/themes/churchope/lib/downloadlink.php. Insufficient path validation lets the supplied path reach the file-download operation and return files outside the intended directory, including wp-config.php and its database credentials. The completed source reports exploitation evidence first observed by Shadowserver on 2023-10-18; that historical observation is not a claim of current active exploitation. Affected versions: before 2.2. The completed CNA record identifies 2.2 as fixed.
| Safe version |
|
||
|---|---|---|---|
| Oct 20, 2026 |
CVE-2014-125134
ChurcHope: Unauthenticated arbitrary file read
An unauthenticated attacker can supply a traversal path through the file parameter to /wp-content/themes/churchope/lib/downloadlink.php. Insufficient path validation lets the supplied path reach the file-download operation and return files outside the intended directory, including wp-config.php and its database credentials. The completed source reports exploitation evidence first observed by Shadowserver on 2023-10-18; that historical observation is not a claim of current active exploitation. Affected versions: before 2.2. The completed CNA record identifies 2.2 as fixed.
|
2.2 |
CVE8.7
|