WordPress NativeChurch Theme Local File Inclusion Scanner

The WordPress NativeChurch Theme is a popular theme used by religious organizations, non-profits, and other community-focused entities for creating engaging and functional websites. It allows users to manage content easily, organize events, and customize the design to suit their needs. The theme includes various built-in features such as event management, sermon management, and custom widgets, making it versatile for various web applications.

Local File Inclusion (LFI) is a serious security vulnerability that occurs when a web application includes files from the server without proper validation. This type of vulnerability allows a malicious user to access sensitive files on a server, such as configuration files or user data, by manipulating the file inclusion function. LFI often arises when the application processes user input without adequate sanitization, leading to directory traversal attacks.

In the NativeChurch Theme, the vulnerability is present in the file inclusion mechanism used for loading templates or assets. Specifically, the vulnerable endpoint is in the theme's customizer or shortcode handler, where a parameter like 'file' or 'template' is passed without proper validation. An attacker can inject path traversal sequences like '../../' to read sensitive files outside the intended directory.

If exploited, an attacker could read critical system files such as wp-config.php, which contains database credentials, or access other sensitive data like user information and private keys. This could lead to full site compromise, data breaches, and unauthorized access to the server. The high CVSS score of 8.0 reflects the severe impact and ease of exploitation.