ChurchCRM
CVE-2026-42289
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious auto-submitting HTML form
-
DeliveryPhish authenticated ChurchCRM admin to page
-
ExploitBrowser sends forged POST to UserEditor.php
-
ExecutionAdmin session authorizes privilege change
-
PersistNew admin/backdoor account created
-
ImpactFull administrative control of instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a currently authenticated ChurchCRM administrator (a user with rights to create accounts or edit permissions via UserEditor.php) visit an attacker-controlled page while holding a valid session - UI:R is the key limiting factor. No attacker credentials are needed (PR:N), and default configurations are vulnerable because UserEditor.php performs no CSRF token validation on POST requests in versions before 7.3.2. What limits exploitation: the attacker cannot act without tricking a privileged admin into loading the malicious content, the admin's session must be active at that moment, and the attack is not automatable at scale (SSVC Automatable: no). There is no dependency on a non-default feature toggle - the missing token check is present in the default account-management workflow. |
| Impact | The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting network reach, low complexity, no attacker privileges, and full compromise of a targeted instance - consistent with SSVC Technical Impact 'total'. However, several signals temper real-world urgency: exploitation requires user interaction (UI:R) - an admin must be lured to a malicious page - and SSVC marks Automatable 'no', so this cannot be sprayed at scale. EPSS is 0.02% (4th percentile) and the CVE is not in CISA KEV, so there is no evidence of active exploitation. The signals are internally consistent (PR:N is correct for CSRF because the attacker holds no credentials and abuses the victim's session; the 'unauthenticated' framing refers to the attacker, not the victim). Net: a genuine high-impact issue for internet-exposed ChurchCRM admin panels, but the interaction requirement and non-automatable nature make it targeted/social-engineering-dependent rather than a mass-exploitation threat. |
| Exploit ScenarioDerived | An attacker hosts a web page containing a hidden auto-submitting form (or image/fetch request) targeting ChurchCRM's UserEditor.php with parameters that grant administrator rights to an attacker-controlled account. The attacker sends the link to a ChurchCRM administrator via phishing; when the logged-in admin opens it, the browser submits the forged request with the admin's session cookie, silently creating an admin backdoor. Proof-of-concept exploitation is reported (SSVC: poc), and low attack complexity means the forged request is trivial to craft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Cross-site request forgery in ChurchCRM's UserEditor.php (versions prior to 7.3.2) lets an unauthenticated attacker forge account-management requests that execute with an authenticated administrator's session. Because the endpoint processes user creation and permission changes from $_POST parameters with no CSRF token, a victim admin who visits a malicious page can be tricked into silently promoting a low-privilege user to administrator or minting a new admin backdoor account. Publicly available exploit code exists (SSVC: poc) but the flaw is not in CISA KEV, and EPSS is very low (0.02%, 4th percentile), indicating no evidence of widespread exploitation.
RemediationAI
Upgrade to ChurchCRM 7.3.2, which adds the missing CSRF protection to UserEditor.php; this is the vendor-released patched version and is the primary fix, as documented in advisory https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3xq9-c86x-cwpp. If immediate upgrade is not possible, reduce exposure by restricting network access to the ChurchCRM admin interface (for example, place it behind a VPN or IP allowlist so administrators do not browse the wider web from the same session context), which limits the chance an admin visits an attacker page while authenticated - the trade-off is reduced convenience for remote administrators. As a browser-side compensating control, administrators should log out of ChurchCRM when not actively using it and avoid opening untrusted links in the same session; SameSite=Strict session cookies at the reverse proxy can also blunt cross-site request delivery, though this may affect legitimate cross-site links into the app. These are stopgaps only - applying the 7.3.2 patch is strongly preferred.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ChurchCRM is a PHP-based open-source church management application (CPE cpe:2.3:a:churchcrm:crm). The affected component, UserEditor.php, handles account creation and permission/role updates but trusts state-changing POST requests without verifying an anti-CSRF token or Origin/Referer, so any request carrying the administrator's session cookie is honored. The root cause maps to CWE-269 (Improper Privilege Management) manifested through a CSRF weakness: the privilege-assignment operation is reachable via forged cross-origin requests, allowing an attacker to control who receives administrator rights. This is a classic session-riding pattern where the browser automatically attaches the victim's authenticated cookie to the attacker-forged form submission.
Know when Churchcrm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CSRF needs no attacker credentials (PR:N) but requires a logged-in admin to visit a malicious page (UI:R); forged privilege change grants full admin, so C/I/A all High.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.
Executive ViewAI
ChurchCRM versions prior to 7.3.2 contain a CSRF vulnerability in UserEditor.php that enables unauthenticated attackers to trick authenticated administrators into creating unauthorized administrator accounts or escalating user privileges, resulting in complete administrative compromise. While publicly available exploit code exists, no evidence of widespread exploitation has been observed. Organizations using affected versions face significant risk of backdoor access and administrative takeover.
No vendor-released patch identified at time of analysis. Implement CSRF token validation on all UserEditor.php POST endpoints, enforce SameSite=Strict and Secure cookie flags, restrict administrator panel access via IP whitelisting or VPN, implement strict Origin and Referer header validation, and disable the UserEditor.php endpoint if not actively required for operations. Establish enhanced monitoring for suspicious administrative account creation and privilege escalation events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
Remote code execution in ChurchCRM versions prior to 6.5.3 allows an authenticated administrator to upload a web shell t
ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter. Ra
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A vulnerability exists in ChurchCRM 5.13.0. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitab
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within th
Authentication bypass in ChurchCRM API middleware enables unauthenticated remote attackers to access all protected endpo
ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET param
Authenticated SQL injection in ChurchCRM's PaddleNumEditor.php endpoint prior to version 6.7.2 allows any logged-in user
ChurchCRM is an open-source church management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Exploit-DB