ChurcHope CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH ChurcHope CVE published 2026-10-20

CVE-2014-125134

The ChurcHope WordPress Theme before version 2.2 is vulnerable to a path traversal attack through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. This allows unauthenticated attackers to download arbitrary files, potentially exposing sensitive information like database credentials. The vulnerability was first observed by the Shadowserver Foundation on 2023-10-18. Defenders shoul [truncated]