{"schema":"threatline.record/2","record":{"id":"CVE-2014-125134","aliases":[],"summary":"ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php","details":"ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.","categories":["Unclassified"],"product":"ChurcHope","vendor":"ChurcHope","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2014-125134","source_modified_at":"2026-10-23T02:07:38.560Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"ChurcHope","vendor":"ChurcHope","versions":[{"version":"0","lessThan":"2.2","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2014-125134","source_modified_at":"2026-10-23T02:07:38.560Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"ChurcHope","ecosystem":null},"version":"2.2","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00638,"percentile":0.49973,"score_date":"2026-10-23"},"published_at":"2026-10-20T20:31:23.591Z","modified_at":"2026-10-23T02:07:38.560Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2014-125134","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T02:07:38.560Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-125134","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://wpscan.com/vulnerability/3c5833bd-1fe0-4eba-97aa-7d3a0c8fda15","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://packetstorm.news/files/id/129706/","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/churchope-lfi.yaml","tags":["technical-description"]},{"source":"CVE List","url":"https://web.archive.org/web/20220629224817/https://www.cloudways.com/en/best-wordpress-themes/nonprofit/church","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/churchope-wordpress-theme-2.2-path-traversal-via-downloadlink-php","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-23T02:07:29.343542Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T02:07:38.560Z","content_hash":"b3bc29f1e5ef7df2e70e19d764a93f39ccb98684ee7192584d4a140e28df2875"}}