Unauthenticated remote code execution in ChurchCRM setup wizard (CVE-2026-42288)

An incomplete fix for CVE-2026-39337 leaves ChurchCRM's setup wizard fully exploitable via an unsanitized DB_PASSWORD field. The raw user-supplied value is substituted directly into a PHP configuration template, allowing a quote-breaking payload containing a shell_exec() call to produce arbitrary OS command execution when the resulting Config.php is loaded on any subsequent request, before any authentication check. An unauthenticated attacker who can reach the setup wizard can achieve full server compromise with a single HTTP POST request. Affected versions: - 7.1.2 We recommend updating to: 7.3.2. CVSS 10.0 · our assessment: act_now Reference: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-mp2w-4q3r-ppx7 Details: https://vuln.today/cve/CVE-2026-42288