What is the CVSS score of CVE-2026-39319?

CVE-2026-39319 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39319?

ChurchCRM versions prior to 7.1.0 contain a second-order SQL injection vulnerability in FundRaiserEditor.php that allows authenticated low-privilege users to remotely extract and modify database…. A patch is available.

How to fix or mitigate CVE-2026-39319?

Within 24 hours: Identify all ChurchCRM instances and document current versions. Within 7 days: Upgrade all ChurchCRM deployments to version 7.1.0 or later; verify upgrade success and test FundRaiserEditor functionality. Within 30 days: Conduct database audit to identify any unauthorized access or modifications; review access logs for suspicious activity by low-privilege accounts; implement principle of least privilege to restrict FundRaiserEditor access to necessary personnel only.

PHP CVE-2026-39319

EUVD-2026-19817 HIGH

SQL Injection (CWE-89)

2026-04-07 security-advisories@github.com

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:22 euvd

EUVD-2026-19817

Analysis Generated

Apr 07, 2026 - 18:22 vuln.today

CVE Published

Apr 07, 2026 - 18:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.

AnalysisAI

Second-order SQL injection in ChurchCRM FundRaiserEditor.php allows authenticated low-privilege users to extract and modify database contents remotely. All versions prior to 7.1.0 are affected. This network-accessible vulnerability requires minimal attack complexity and no user interaction, enabling authenticated attackers to achieve full database compromise (confidentiality, integrity, and availability impact). EPSS data not available; no public exploit identified at time of analysis, though vulnerability details are disclosed in GitHub security advisory.

Technical ContextAI

This vulnerability exploits a second-order SQL injection flaw in ChurchCRM's FundRaiserEditor.php endpoint. Second-order SQL injection occurs when user-controlled data is stored in the application (typically in session variables or database) and later used in SQL queries without proper sanitization. In this case, the iCurrentFundraiser PHP session parameter serves as the injection vector. Unlike first-order SQL injection where the payload executes immediately, second-order attacks inject malicious SQL that persists in the session state and executes during subsequent database operations. The root cause falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating inadequate input validation and parameterized query implementation. ChurchCRM is a PHP-based church management system handling sensitive organizational data including member information, financial records, and fundraising activities, making database access particularly impactful.

RemediationAI

Upgrade immediately to ChurchCRM version 7.1.0 or later, which contains fixes for this SQL injection vulnerability. Organizations should prioritize this upgrade given the high CVSS score and potential for database compromise. The vendor-released patch addresses the improper handling of the iCurrentFundraiser session parameter in FundRaiserEditor.php. Download the patched version from the official ChurchCRM repository and follow standard upgrade procedures including database backups before migration. No workarounds are available for versions prior to 7.1.0; upgrading is the only effective mitigation. After patching, conduct security reviews of user accounts to identify any potentially compromised sessions or unauthorized database modifications. Organizations unable to patch immediately should implement additional network-layer access controls to restrict FundRaiserEditor.php access to trusted IP addresses only, though this is a temporary measure. Consult the GitHub security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vg4m-hc29-jgqj for additional vendor guidance and technical details.