The ChurcHope WordPress theme before version 2.2 contains a path traversal flaw in the downloadlink.php file. Unauthenticated users can manipulate the file parameter to download any file on the server, including sensitive configuration files such as wp-config.php or system files such as /etc/passwd. This exposure can enable an attacker to obtain database credentials or other confidential data, but it does not by itself provide code execution or control over the server. The vulnerability is classified as CWE‑22.

WordPress sites that are using the ChurcHope theme so far as 2.1 are affected. Any installation that has the theme deployed and the downloadlink.php endpoint accessible is vulnerable. The flaw applies to all operating systems supported by WordPress, as the traversal sequence works across file system boundaries.

The CVSS score of 8.7 signals a high severity, and the lack of an EPSS score means the current exploitation probability is not explicitly quantified, but the lack of KEV listing suggests it has not been cataloged as a known exploited vulnerability. An attacker can exploit the flaw via a simple HTTP GET request to /wp-content/themes/churchope/lib/downloadlink.php?file=… without authentication, making the risk very high for sites that have not applied a fix.