Orgs at Risk: ChurcHope Theme Path Traversal Leaks Config Data and Passwords
Sites running ChurcHope WordPress theme versions prior to 2.2 face high-severity risks from unauthenticated file access flaws that expose sensitive configuration data.
Key points
- The vulnerability allows unauthenticated attackers to read arbitrary files via directory traversal sequences.
- Sensitive data such as wp-config.php and system passwords can be accessed through the download link script.
- Shadowserver Foundation observed exploitation evidence for this flaw on October 18, 2023.
Managed service providers must immediately audit client environments for the ChurcHope WordPress theme. Versions before 2.2 contain a high-severity path traversal vulnerability rated 8.7 by the National Vulnerability Database. This flaw permits unauthenticated attackers to download arbitrary files from the server. The risk is significant because it exposes database credentials and other sensitive system files without requiring login access.
How it unfolded
- The ChurcHope theme for WordPress versions prior to 2.2 was identified as containing a path traversal weakness.
- Attackers exploited the 'file' parameter in the theme's download link library to traverse directories.
- The Shadowserver Foundation first observed evidence of active exploitation on October 18, 2023.
Who is affected
Any WordPress installation using the ChurcHope theme in a version earlier than 2.2 is vulnerable. The flaw resides in the file located at /wp-content/themes/churchope/lib/downloadlink.php. Because the vulnerability is unauthenticated, any internet-facing site running this specific theme version is at risk. Attackers can supply directory traversal sequences to read critical files. This includes wp-config.php, which holds database passwords, and system files like /etc/passwd.
Our take on the response
The severity rating of 8.7 reflects the ease of exploitation and the value of the exposed data. Unlike the QNAP QuMagie path traversal flaw reported by Patch Observer on October 15, 2026, which required authentication, this WordPress issue does not. That suggests the attack surface is significantly broader. The fact that exploitation was observed by Shadowserver indicates the flaw is not theoretical. Providers must treat this as an active threat rather than a future risk. Immediate remediation is required to prevent credential theft.
Who needs to act first
Teams should prioritize sites with public-facing WordPress installations running the ChurcHope theme. Identify systems with the highest external exposure first, as these are most likely to be scanned by automated tools. Check whether the theme is actively used or if it is dormant but still present in the codebase. Back up the current site configuration before making any changes to the theme files or directory structure. Test the update in a staging environment to ensure no site functionality breaks. Roll out the fix to production only after confirming stability. Monitor access logs for unusual file download requests during the transition period.
What to do and how to stay safe
- Inventory all managed WordPress sites to identify those using the ChurcHope theme and check their version numbers against the vulnerable range.
- Apply the theme update to version 2.2 or later as soon as the vendor provides the patch to close the path traversal gap.
- Review server access logs for requests targeting the download link script to detect any prior unauthorized file access attempts.
- Rotate database credentials
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
