What is the CVSS score of CVE-2026-39334?

CVE-2026-39334 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39334?

ChurchCRM version 7.0.5 contains a SQL injection vulnerability in the Settings module that allows authenticated users with low privileges to compromise the entire database, including member records,…. A patch is available.

How to fix or mitigate CVE-2026-39334?

Within 24 hours: Identify all systems running ChurchCRM 7.0.5 and restrict access to the /SettingsIndividual.php endpoint at the network or application level. Within 7 days: upgrade all affected instances to ChurchCRM version 7.1.0 or later. Within 30 days: conduct a database audit to detect any unauthorized modifications or extractions during the exposure period, and reset credentials for any accounts with Settings access.

PHP CVE-2026-39334

EUVD-2026-19831 HIGH

SQL Injection (CWE-89)

2026-04-07 GitHub_M

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19831

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:38 nvd

HIGH 8.8

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /SettingsIndividual.php in ChurchCRM 7.0.5. Authenticated users without any specific privileges can inject arbitrary SQL statements through the type array parameter via the index and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM 7.0.5 /SettingsIndividual.php endpoint allows authenticated low-privilege users to extract, modify, or delete database contents remotely. The vulnerability exploits insufficient input validation on the type array parameter, enabling arbitrary SQL statement execution. ChurchCRM is an open-source church management system handling sensitive member data including personal information, donations, and pastoral records. Fixed in version 7.1.0. EPSS data unavailable; no public exploit identified at time of analysis; not listed in CISA KEV.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) affecting the ChurchCRM open-source church management platform written in PHP. The flaw exists in the /SettingsIndividual.php endpoint where user-supplied input via the 'type' array parameter's index is incorporated into SQL queries without proper sanitization or parameterized query usage. SQL injection occurs when attackers manipulate database queries by injecting malicious SQL code through application inputs. In PHP applications using MySQL/MariaDB backends (typical for ChurchCRM), array parameters can be particularly dangerous when developers fail to validate array indices or values before database operations. The affected CPE (cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:*) identifies all ChurchCRM versions prior to 7.1.0 as vulnerable. Church management systems typically contain highly sensitive personally identifiable information (PII) including names, addresses, contact details, family relationships, financial contributions, and pastoral care notes, making this vulnerability particularly severe for affected organizations.

RemediationAI

Upgrade immediately to ChurchCRM version 7.1.0 or later, which contains the vendor-released patch addressing this SQL injection vulnerability. The official security advisory and patch details are available at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8g53-72jr-39w6. Organizations should follow standard upgrade procedures including backing up the database before applying updates, testing the new version in a staging environment if possible, and verifying all functionality post-upgrade. As an interim measure until patching can be completed, organizations could implement web application firewall (WAF) rules to filter suspicious array parameter inputs to /SettingsIndividual.php, restrict access to this endpoint to only necessary administrator accounts through authentication layer controls, or temporarily disable the affected functionality if operationally feasible. However, these workarounds are not substitutes for applying the official patch. Post-remediation, administrators should review database audit logs for any suspicious query patterns prior to patch deployment to identify potential exploitation attempts, and consider rotating database credentials as a precautionary measure given the potential for credential extraction via SQL injection.