Which versions of PHP are affected by CVE-2026-39342?

ChurchCRM versions before 7.1.0 contain a critical SQL injection vulnerability in the Advanced Search feature that allows authenticated users with reporting access to execute arbitrary database…. A patch is available.

How to fix or mitigate CVE-2026-39342?

Within 24 hours: Inventory all ChurchCRM deployments and identify current versions. Within 7 days: Upgrade all instances to ChurchCRM version 7.1.0 or later; apply in test environment first to validate compatibility. Within 30 days: Audit database access logs for the QueryView.php Advanced Search feature (QueryID=15) to detect any unauthorized SQL activity; restrict Data/Reports access to only essential staff pending upgrade completion.

PHP CVE-2026-39342

Q: What is the CVSS score of CVE-2026-39342?

CVE-2026-39342 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19845 CRITICAL

SQL Injection (CWE-89)

2026-04-07 security-advisories@github.com

PHP SQLi

9.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:22 euvd

EUVD-2026-19845

Analysis Generated

Apr 07, 2026 - 18:22 vuln.today

CVE Published

Apr 07, 2026 - 18:16 nvd

CRITICAL 9.4

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL injection. The authenticated user requires access to Data/Reports > Query Menu and access to the "Advanced Search" query. This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM's QueryView.php allows authenticated users with Data/Reports access to execute arbitrary SQL commands via the searchwhat parameter when using QueryID=15 (Advanced Search). Affects all versions prior to 7.1.0. CVSS 9.4 critical severity reflects network-accessible attack requiring low privileges with high impact across confidentiality, integrity, and availability. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis. Vendor-released patch available in version 7.1.0.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management system for member records, donations, and administrative functions. This vulnerability (CWE-89: SQL Injection) exists in QueryView.php where the searchwhat parameter lacks proper input sanitization when processing QueryID=15 (Advanced Search query). The flaw allows injection of arbitrary SQL commands into database queries. Attack requires authenticated access with specific permissions to the Data/Reports module and Query Menu functionality, indicating the vulnerable code path is within the application's reporting and search subsystems. SQL injection vulnerabilities of this class can lead to complete database compromise including unauthorized data extraction, modification, deletion, and potential operating system command execution depending on database configuration and privileges.

RemediationAI

Upgrade immediately to ChurchCRM version 7.1.0 or later, which contains fixes for the SQL injection vulnerability in QueryView.php. Download the patched release from the official ChurchCRM GitHub repository. As a temporary mitigation measure if immediate patching is not feasible, restrict access to the Data/Reports module and Query Menu functionality to only highly trusted administrative users, and implement database-level query monitoring to detect potential SQL injection attempts. Review application logs for suspicious searchwhat parameter values in QueryView.php requests with QueryID=15. Consult the vendor security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-7fr4-mvfm-cxfx for additional guidance and upgrade instructions.