CVE-2014-125134 ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php

Q: What is CVE-2014-125134?

CVE-2014-125134 is a high-severity vulnerability in ChurcHope, published on 20 Oct 2026.

Q: Is CVE-2014-125134 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-125134 exists.

Q: How do I fix CVE-2014-125134?

No fix has been published for CVE-2014-125134 yet. Limit exposure of the affected software until one is available.

High 8.7 Published 20 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2014-125134?

CVE-2014-125134 is a high-severity vulnerability in ChurcHope, published on 20 Oct 2026.

Official description

ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Weakness: CWE-22

Which versions are affected by CVE-2014-125134?

How do I fix CVE-2014-125134?

No fix has been published for CVE-2014-125134 yet. Limit exposure of the affected software until one is available.

Is CVE-2014-125134 being exploited?