Input validation vulnerability in ChurcHope 2.1

The ChurchHope theme for WordPress is vulnerable to a security risk called Local File Inclusion. This vulnerability exists in versions of ChurchHope up to and including 2.1 and is caused by a parameter called ‘file’ in the ‘downloadlink.php’ file. An attacker without proper access to the site can use this vulnerability to include and execute any arbitrary file on the server. This can give the attacker the ability to bypass access controls, steal sensitive information, or even execute code on the server if the attacker can upload and include certain image or file types.