What is the CVSS score of CVE-2026-39343?

CVE-2026-39343 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39343?

ChurchCRM versions 7.0.x and earlier contain a SQL injection vulnerability in event type management that allows authenticated administrators to compromise the entire database, including sensitive…. A patch is available.

How to fix or mitigate CVE-2026-39343?

Within 24 hours: Identify all ChurchCRM instances and document current versions in your environment. Within 7 days: Upgrade all ChurchCRM deployments to version 7.1.0 or later, beginning with production environments; test thoroughly in staging first. Within 30 days: Audit administrative user accounts and access logs for suspicious SQL activity or database access patterns using ChurchCRM's audit trail if available; document completion of patching across all instances.

PHP CVE-2026-39343

EUVD-2026-19847 HIGH

SQL Injection (CWE-89)

2026-04-07 security-advisories@github.com

PHP SQLi

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:02 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:22 euvd

EUVD-2026-19847

Analysis Generated

Apr 07, 2026 - 18:22 vuln.today

CVE Published

Apr 07, 2026 - 18:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, which is only accessible to administrators. The EN_tyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute arbitrary SQL commands directly against the database. This vulnerability is fixed in 7.1.0.

AnalysisAI

SQL injection in ChurchCRM 7.0.x and earlier allows authenticated administrators to execute arbitrary SQL commands via unsanitized EN_tyid parameter in EditEventTypes.php. While requiring high-privilege administrative access (CVSS PR:H), successful exploitation enables complete database compromise including data exfiltration, modification, and potential server-level access through database features. Patched in version 7.1.0. No public exploit identified at time of analysis, EPSS data not available for assessment.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management system handling member records, donations, and event scheduling. This vulnerability represents a classic CWE-89 SQL injection flaw where the EditEventTypes.php administrative interface fails to sanitize the EN_tyid POST parameter before incorporating it into SQL queries. The lack of parameterized queries or input validation allows direct SQL command injection. As a PHP application, ChurchCRM likely uses MySQL or MariaDB as the backend database. The vulnerability scope is limited to the event types management functionality, but SQL injection at this level can pivot to affect any database tables within the application's database context. The administrative access requirement (PR:H in CVSS vector) significantly reduces the attack surface compared to unauthenticated SQL injection, but represents a critical insider threat vector or privilege escalation path if lower-privilege accounts are compromised first.

RemediationAI

Upgrade ChurchCRM to version 7.1.0 or later immediately, which contains patches that properly sanitize the EN_tyid parameter and implement secure parameterized SQL queries. Download the patched release from the official ChurchCRM GitHub repository and follow standard upgrade procedures including database backups before migration. Review the vendor security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-h2hx-p9gp-q7gr for additional guidance. No effective workarounds exist short of removing administrator access to the EditEventTypes.php functionality, which would break legitimate event management workflows. Post-upgrade, audit administrator account usage and implement principle of least privilege by restricting admin access to only personnel requiring event type configuration capabilities. Enable database query logging temporarily to detect any prior exploitation attempts showing unusual SQL patterns in EditEventTypes.php requests. Consider implementing web application firewall rules to detect SQL injection patterns as defense-in-depth, though upgrading remains the primary mitigation.