{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/churchope--2.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:churchope:churchope:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2014-125134"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ChurcHope (\u003c 2.2)"],"_cs_severities":["high"],"_cs_tags":["wordpress","path-traversal","web-application-attack"],"_cs_type":"threat","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe ChurcHope theme for WordPress, prior to version 2.2, contains a critical path traversal vulnerability. This flaw resides in the 'file' parameter of the 'downloadlink.php' script located at '/wp-content/themes/churchope/lib/downloadlink.php'. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP GET requests containing directory traversal sequences (e.g., '../') to access files outside of the intended directory. Successful exploitation allows an attacker to retrieve sensitive configuration files such as 'wp-config.php', which often contains database credentials, or system files like '/etc/passwd'. This vulnerability has been subject to exploitation in the wild since October 18, 2023, as reported by the Shadowserver Foundation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance on the target WordPress site to identify the use of the ChurcHope theme.\u003c/li\u003e\n\u003cli\u003eAttacker probes the known vulnerable path: '/wp-content/themes/churchope/lib/downloadlink.php'.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET request with the 'file' parameter containing traversal payloads (e.g., 'file=../../wp-config.php').\u003c/li\u003e\n\u003cli\u003eThe web server processes the request and passes the malicious path to the PHP script.\u003c/li\u003e\n\u003cli\u003eThe application fails to sanitize the input, allowing the script to read the requested file from the filesystem.\u003c/li\u003e\n\u003cli\u003eThe server returns the contents of the target sensitive file in the HTTP response body.\u003c/li\u003e\n\u003cli\u003eAttacker parses the returned file content to extract database passwords, keys, or other sensitive configuration data.\u003c/li\u003e\n\u003cli\u003eAttacker uses the harvested credentials for further unauthorized access or database manipulation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to the disclosure of sensitive server-side information, including database credentials stored in 'wp-config.php'. This can result in complete site compromise, data exfiltration, or further unauthorized access to the underlying server environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the ChurcHope WordPress theme to version 2.2 or later immediately to patch CVE-2014-125134.\u003c/li\u003e\n\u003cli\u003eImplement the provided Sigma rule in your webserver monitoring environment to detect attempts to exploit this specific directory traversal vector.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous requests to 'downloadlink.php' that include '..' sequences in the query string.\u003c/li\u003e\n\u003cli\u003eIf an exploit is identified, immediately rotate database credentials, security keys, and salts defined in 'wp-config.php'.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T21:53:07Z","date_published":"2026-10-20T21:53:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-churchope-path-traversal/","summary":"The ChurcHope theme for WordPress before version 2.2 is vulnerable to an unauthenticated path traversal attack, allowing remote adversaries to read arbitrary files from the host server.","title":"ChurcHope WordPress Theme: Arbitrary file download via path traversal (CVE-2014-125134)","url":"https://feed.craftedsignal.io/briefs/2026-10-churchope-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - ChurcHope (\u003c 2.2)","version":"https://jsonfeed.org/version/1.1"}