WordPress security by component
nativechurch
nativechurch is a WordPress theme with 2 published CVE records in this archive. The latest tracked vulnerability was published Oct 20, 2026; the highest published CVSS base score is 8.7.
Theme slug:
nativechurchLatest vulnerability
CVE-2014-125133: NativeChurch: Unauthenticated arbitrary file read
An unauthenticated attacker can supply a traversal path through the file parameter to download.php. Insufficient path validation lets the supplied path reach the file-download operation and return files outside the intended directory, including wp-config.php and its database credentials. The completed source reports exploitation evidence first observed by Shadowserver on 2023-10-19; that historical observation is not a claim of current active exploitation. Affected versions: before 1.6.2. The completed CNA record identifies 1.6.2 as fixed.
| Safe version |
|
||
|---|---|---|---|
| Oct 20, 2026 |
CVE-2014-125133
NativeChurch: Unauthenticated arbitrary file read
An unauthenticated attacker can supply a traversal path through the file parameter to download.php. Insufficient path validation lets the supplied path reach the file-download operation and return files outside the intended directory, including wp-config.php and its database credentials. The completed source reports exploitation evidence first observed by Shadowserver on 2023-10-19; that historical observation is not a claim of current active exploitation. Affected versions: before 1.6.2. The completed CNA record identifies 1.6.2 as fixed.
|
1.6.2 |
CVE8.7
|
| Jul 02, 2026 |
CVE-2026-27408
NativeChurch: Cross-site scripting
NativeChurch is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 4.8.8.2.
|
See mitigation notes |
CVE7.1
|