CVE-2014-125134: ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ChurcHope WordPress Themeto a version that resolves this vulnerability.Fixed in 2.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the affected WordPress site's downloadlink.php endpoint can exploit it. No login or user interaction is required.
What access does exploitation provide?
An attacker can use directory-traversal sequences in the file parameter to download arbitrary files readable by the web server. This may expose wp-config.php, database credentials, or system files such as /etc/passwd.
Are installations using the affected theme by default exposed?
The vulnerable endpoint is located at /wp-content/themes/churchope/lib/downloadlink.php. A site using a ChurcHope theme version before 2.2 is affected if that endpoint is reachable.
How can defenders determine whether exploitation has occurred?
Review web-server and application logs for requests to /wp-content/themes/churchope/lib/downloadlink.php, especially file parameter values containing directory-traversal sequences. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
What can be done if updating is not immediately possible?
Restrict access to or disable the downloadlink.php endpoint to prevent unauthenticated requests from reaching the vulnerable code. Treat potentially exposed wp-config.php database credentials as compromised and rotate them where exposure is suspected.