{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3anativechurch_projectnativechurchwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nativechurch_project:nativechurch:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2014-125133"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NativeChurch theme (\u003c 1.6.2)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","wordpress","path-traversal"],"_cs_type":"threat","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe NativeChurch theme for WordPress, in versions prior to 1.6.2, contains a critical path traversal vulnerability within the 'download.php' script. This vulnerability allows an unauthenticated, remote attacker to manipulate the 'file' parameter in a GET request to access sensitive files outside of the intended directory. By utilizing directory traversal sequences (e.g., '../'), an attacker can retrieve configuration files such as 'wp-config.php', which typically contains database credentials and other security-sensitive information. This vulnerability was reportedly observed in the wild by the Shadowserver Foundation as early as October 2023. Given the ease of exploitation, organizations running this specific theme must update to version 1.6.2 or later to mitigate the risk of information disclosure and potential account takeover or database compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify WordPress sites running the vulnerable NativeChurch theme.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP GET request targeting 'download.php'.\u003c/li\u003e\n\u003cli\u003eAttacker appends directory traversal sequences (e.g., '../../wp-config.php') to the 'file' parameter.\u003c/li\u003e\n\u003cli\u003eThe web server process receives the crafted request and fails to sanitize the path input.\u003c/li\u003e\n\u003cli\u003eThe application logic passes the unsanitized path to the file system API.\u003c/li\u003e\n\u003cli\u003eThe file system retrieves the contents of the requested file (e.g., 'wp-config.php') from outside the intended base directory.\u003c/li\u003e\n\u003cli\u003eThe server returns the sensitive file content in the HTTP response body.\u003c/li\u003e\n\u003cli\u003eAttacker parses the response to extract credentials or configuration data for further exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read sensitive files on the server. The primary impact is the unauthorized disclosure of 'wp-config.php', which often contains database hostnames, usernames, and passwords. This exposure can lead to full database compromise, subsequent secondary exploitation of the site, and the potential for complete site takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the NativeChurch WordPress theme to version 1.6.2 or later immediately to patch CVE-2014-125133.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to web server access logs to detect and block attempts to use directory traversal sequences within the 'download.php' file parameter.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for HTTP 200 responses to 'download.php' requests that contain 'wp-config.php' in the query string.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:53:00Z","date_published":"2026-10-20T21:53:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nativechurch-path-traversal/","summary":"The NativeChurch WordPress theme before version 1.6.2 is vulnerable to unauthenticated path traversal via the download.php file parameter, allowing for the arbitrary download of sensitive system files.","title":"NativeChurch WordPress theme path traversal (CVE-2014-125133)","url":"https://feed.craftedsignal.io/briefs/2026-10-nativechurch-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:nativechurch_project:nativechurch:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}