CVE-2014-125134: WordPress ChurcHope Path Traversal Flaw

CVE-2014-125134 Overview

CVE-2014-125134 is a path traversal vulnerability [CWE-22] in the ChurcHope theme for WordPress before version 2.2. The flaw resides in /wp-content/themes/churchope/lib/downloadlink.php, where the file parameter is passed to a download routine without validation. Unauthenticated remote attackers can supply directory traversal sequences to retrieve arbitrary files from the web server. Sensitive targets include wp-config.php, which exposes database credentials and authentication secrets, and operating system files such as /etc/passwd. The Shadowserver Foundation first observed exploitation evidence on 2023-10-18.

Critical Impact

Unauthenticated attackers can read arbitrary files including WordPress database credentials, enabling full site compromise.

Affected Products

• ChurcHope WordPress theme versions prior to 2.2
• WordPress sites hosting the vulnerable downloadlink.php script
• Any environment exposing /wp-content/themes/churchope/lib/ to the internet

Discovery Timeline

• 2023-10-18 - Shadowserver Foundation observed in-the-wild exploitation evidence
• 2026-10-20 - CVE-2014-125134 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2014-125134

Vulnerability Analysis

The ChurcHope theme ships a file download helper located at /wp-content/themes/churchope/lib/downloadlink.php. The script accepts a user-supplied file parameter and returns its contents without authentication or sanitization. Because the handler does not restrict the path, attackers can supply traversal sequences such as ../../../../wp-config.php to escape the theme directory. Successful retrieval of wp-config.php exposes the WordPress database host, username, password, table prefix, and authentication salts. With database credentials, attackers can modify administrative accounts, inject malicious content, or exfiltrate user data. The flaw requires no privileges and no user interaction, and it is reachable over the network.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The downloadlink.php handler concatenates attacker-controlled input into a file path without applying a whitelist, canonicalization check, or basename() normalization. There is no authentication layer enforcing that the request originates from a logged-in administrator.

Attack Vector

Exploitation is performed with a single HTTP GET request to the vulnerable endpoint. The attacker appends relative path traversal sequences to the file query parameter until the target file is reached. Public detection tooling, including a Nuclei template published by ProjectDiscovery, automates discovery of exposed instances. A proof of concept is also archived on Packet Storm.

// Example exploitation code (sanitized)
See the public Nuclei template and Packet Storm advisory listed above for the exact HTTP request format. No proprietary exploit code is reproduced here.

Detection Methods for CVE-2014-125134

Indicators of Compromise

• HTTP requests to /wp-content/themes/churchope/lib/downloadlink.php containing a file= parameter
• Query strings containing traversal sequences such as ../, ..%2f, or encoded variants targeting wp-config.php or /etc/passwd
• Unexpected outbound connections from the web host to attacker-controlled infrastructure after credential disclosure
• Web server access logs showing 200 responses for downloadlink.php with abnormally large response sizes

Detection Strategies

• Deploy the ProjectDiscovery Nuclei template for ChurcHope LFI against external WordPress inventory
• Review web application firewall logs for path traversal patterns against theme and plugin paths
• Correlate database authentication events with preceding reads of wp-config.php to spot credential reuse

Monitoring Recommendations

• Alert on any GET request to downloadlink.php carrying a file parameter containing .. or URL-encoded equivalents
• Monitor WordPress audit logs for new administrator accounts or role changes following suspected disclosure
• Track filesystem read access to wp-config.php outside normal PHP-FPM worker patterns

How to Mitigate CVE-2014-125134

Immediate Actions Required

• Upgrade the ChurcHope theme to version 2.2 or later, which addresses the path traversal
• If the theme is no longer maintained for your site, remove /wp-content/themes/churchope/ entirely
• Rotate all WordPress database credentials and authentication keys defined in wp-config.php
• Audit administrator accounts and recently modified posts, plugins, and uploads for signs of compromise

Patch Information

The vulnerability is fixed in ChurcHope theme version 2.2. Review the VulnCheck advisory and the WPScan vulnerability report for version metadata and remediation guidance.

Workarounds

• Block external access to /wp-content/themes/churchope/lib/downloadlink.php at the web server or WAF
• Add a WAF rule denying requests whose file parameter contains .., %2e%2e, or absolute paths
• Restrict filesystem permissions so the web server user cannot read wp-config.php outside the WordPress runtime context

# Configuration example
# nginx: block the vulnerable endpoint
location ~* /wp-content/themes/churchope/lib/downloadlink\.php$ {
    return 403;
}

# Apache (.htaccess): deny access to the vulnerable script
<Files "downloadlink.php">
    Require all denied
</Files>