PHP CVE-2026-40581

Exploitation requires the SelectDelete.php endpoint to accept family record deletion via GET requests without CSRF token validation, which affects all ChurchCRM versions before 7.2.0 in default configuration. Attack prerequisites: (1) targeted administrator must have an active authenticated session to the ChurchCRM instance, (2) attacker must successfully social engineer the administrator into visiting a malicious webpage via phishing, watering hole, or malicious advertisement while that session is active, (3) attacker must know or enumerate valid family record IDs to target specific deletions (though sequential ID guessing could enable mass deletion campaigns). User interaction (UI:R) is mandatory - the victim must click a link or visit a compromised site. No special ChurchCRM configuration, non-default features, or elevated privileges beyond standard administrator access are required. Browsers with third-party cookie blocking or same-site cookie policies may partially mitigate exploitation by preventing cross-origin cookie transmission, though administrators using the same browser session for both ChurchCRM and external browsing remain vulnerable.

Real-world risk is MODERATE despite the 8.1 CVSS score. The CVSS vector correctly identifies high integrity and availability impact (I:H/A:H) since attackers can permanently delete critical church records. However, the PR:N metric is misleading - while the attacker needs no authentication, successful exploitation requires an authenticated administrator to be socially engineered into visiting a malicious page (UI:R), significantly raising the practical attack complexity. No EPSS score provided, but CSRF vulnerabilities typically have lower exploitation probability than RCE due to requiring social engineering and timing (admin must be logged in). Not listed in CISA KEV, suggesting no widespread active exploitation. The attack is trivially automatable once victim interaction occurs (single GET request), but targeting requires knowing administrator email addresses or web browsing patterns. Technical impact is severe for targeted organizations (permanent data loss of family records, financial pledges, personal information), making this a priority for ChurchCRM installations but not an internet-wide emergency. The GitHub advisory and commit-level fix (rather than tagged release announcement) suggest responsible disclosure and rapid remediation. Organizations should prioritize patching if administrators routinely access external links from their work browsers.

An attacker identifies a ChurchCRM installation through reconnaissance (version disclosure, Shodan search, or targeting known churches). They craft an HTML page containing an invisible image tag with src pointing to the vulnerable SelectDelete.php endpoint with parameters specifying a target family ID: <img src='https://victim-church.example/SelectDelete.php?FamilyID=123&Confirmed=true' style='display:none'>. The attacker then sends a phishing email to church administrators with a link to this malicious page, disguised as a relevant church resource or donation portal. When an administrator clicks the link while logged into ChurchCRM, their browser automatically sends the GET request with valid session cookies, triggering permanent deletion of family record 123 and all associated member data, pledges, and notes without any confirmation prompt or audit trail linking to the external attack.