What is the CVSS score of CVE-2026-24854?

CVE-2026-24854 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-24854?

A SQL Injection vulnerability in ChurchCRM's paddle number editor could allow attackers to extract or manipulate sensitive church member and financial data.. A patch is available.

Is there a public PoC exploit available for CVE-2026-24854?

Yes, a public proof-of-concept exploit is available for CVE-2026-24854. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-24854?

Within 24 hours: Identify all ChurchCRM instances and document current versions; assess whether the vulnerable endpoint is exposed to untrusted networks. Within 7 days: Apply vendor patch to upgrade ChurchCRM to version 6.7.2 or later across all production systems. Within 30 days: Conduct post-patch validation and review database access logs for signs of exploitation.

PHP CVE-2026-24854

HIGH

SQL Injection (CWE-89)

2026-01-30 security-advisories@github.com

PHP SQLi Churchcrm

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Feb 17, 2026 - 14:33 vuln.today

Public exploit code

Patch released

Feb 17, 2026 - 14:33 nvd

Patch available

CVE Published

Jan 30, 2026 - 16:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint /PaddleNumEditor.php in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the PerID parameter. Version 6.7.2 contains a patch for the issue.

AnalysisAI

Authenticated SQL injection in ChurchCRM's PaddleNumEditor.php endpoint prior to version 6.7.2 allows any logged-in user to execute arbitrary database queries regardless of their assigned permissions. Public exploit code exists for this vulnerability, enabling attackers with valid credentials to read, modify, or delete sensitive church data. Update to version 6.7.2 or later to remediate.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Churchcrm. ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint /PaddleNumEditor.php in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the PerID parameter. Version 6.7.2 contains a patch for the issue.

RemediationAI

A vendor patch is available — apply it immediately. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.