What is the CVSS score of CVE-2026-42288?

CVE-2026-42288 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ChurchCRM are affected by CVE-2026-42288?

Any organization running ChurchCRM before version 7.3.2 has an undefended entry point that allows attackers to gain complete control of the system without authentication.

How to fix or mitigate CVE-2026-42288?

Within 24 hours: inventory all ChurchCRM installations and identify those running versions before 7.3.2; assess which are internet-facing or accessible to untrusted networks. Within 7 days: implement network controls to restrict access to the setup wizard (disable if already configured), apply WAF rules to block exploitation attempts targeting the DB_PASSWORD parameter, and subscribe to vendor security updates. Within 30 days: upgrade all ChurchCRM instances to version 7.3.2 or later, or migrate to alternative solutions if upgrades are not feasible; validate that setup wizard access is disabled on production systems.

ChurchCRM CVE-2026-42288

CRITICAL

Code Injection (CWE-94)

2026-05-12 GitHub_M

RCE Code Injection Churchcrm Crm

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Network-reachable setup wizard, no auth or interaction (PR:N/UI:N/AC:L); code injection escapes the app to the host (S:C) yielding total C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:06 vuln.today

CVE Published

May 12, 2026 - 22:25 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard via unsanitized DB_PASSWORD remains fully exploitable This vulnerability is fixed in 7.3.2.

AnalysisAI

Pre-authentication remote code execution in ChurchCRM before 7.3.2 allows unauthenticated attackers to inject and execute arbitrary code through the setup wizard's unsanitized DB_PASSWORD field. This vulnerability exists because the patch for CVE-2026-39337 was incomplete, leaving the original CWE-94 code injection fully exploitable; publicly available exploit code exists (SSVC exploitation status: poc), and CISA's SSVC framework rates it as automatable with total technical impact. Despite the maximum CVSS score of 10.0, EPSS estimates only a 0.27% 30-day exploitation probability (51st percentile), indicating it is not yet observed in widespread automated campaigns.

Technical ContextAI

ChurchCRM is an open-source, PHP-based church management system (CPE cpe:2.3:a:churchcrm:crm) used to manage congregations, membership, donations, and events. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): input supplied to the DB_PASSWORD parameter during the initial setup wizard is written into an execution context (typically a generated configuration file) without sanitization or escaping, so attacker-controlled content is interpreted as PHP/code rather than treated as inert data. This is a regression - the prior remediation for CVE-2026-39337 addressed the symptom but not the full injection sink, so the same setup-wizard code path remains exploitable in all versions prior to 7.3.2.

RemediationAI

Vendor-released patch: 7.3.2 - upgrade every ChurchCRM instance to 7.3.2 or later immediately, as this is the only complete fix and the previous CVE-2026-39337 patch does not protect you. Until you can upgrade, restrict or block network access to the setup wizard endpoint (for example via web-server access control, IP allow-listing, or authentication in front of the application), since it is the exploit vector; note the trade-off that this can interfere with legitimate first-time configuration. Also ensure the application is not left in an installable/setup state after deployment and confirm setup is locked once configured. Refer to the vendor advisory GHSA-mp2w-4q3r-ppx7 (https://github.com/ChurchCRM/CRM/security/advisories/GHSA-mp2w-4q3r-ppx7) for authoritative fix guidance.