What is the CVSS score of CVE-2026-58409?

CVE-2026-58409 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of ChurchCRM are affected by CVE-2026-58409?

ChurchCRM versions before 7.4.0 contain a critical vulnerability allowing authenticated administrators to achieve full server compromise through malicious plugin installation.

How to fix or mitigate CVE-2026-58409?

Within 24 hours: identify all ChurchCRM deployments, restrict administrative access to essential personnel only, and disable the remote plugin installation feature (/plugins/install-url endpoint). Within 7 days: implement file integrity monitoring and logging for the /plugins directory, conduct forensic review for unauthorized PHP files, and restrict web server permissions on plugin directories. Within 30 days: coordinate with ChurchCRM developers for patch availability; if no patch is released, plan migration to alternative church management software or permanently disable plugin installation capability by applying write-protection to the plugins directory.

ChurchCRM CVE-2026-58409

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-13 GitHub_M

PHP RCE File Upload Churchcrm Crm

9.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Network-reachable admin endpoint (AV:N/AC:L/UI:N) but requires administrator privileges (PR:H); web-app admin escalating to an OS shell crosses an authority boundary (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:01 vuln.today

CVE Published

Jul 13, 2026 - 20:05 cve.org

CRITICAL 9.1

DescriptionCVE.org

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist (DENIED_EXTENSIONS) fails to block standard .php files. Because php is explicitly included in the allowed extension list for plugin archives, and extracted files are placed directly under the web root, any PHP file inside the ZIP becomes immediately executable via HTTP - without even needing to "enable" the plugin through the application UI. The /plugins/install-url API route (management.php) allows an administrator to source the malicious ZIP from any attacker-controlled HTTPS URL, validating it only against an attacker-supplied SHA-256 hash. This issue has been fixed in version 7.4.0.

Articles & Coverage 1

News Critical RCE in ChurchCRM before 7.4.0 via Malicious Plugin Upload - CVE-2026-58409 Jul 14, 2026

AnalysisAI

Remote code execution in ChurchCRM before 7.4.0 lets an authenticated administrator run arbitrary PHP on the server by installing a plugin ZIP that contains a webshell. Because 'php' is explicitly whitelisted in ALLOWED_EXTENSIONS and the DENIED_EXTENSIONS denylist fails to catch standard .php files, any PHP file inside the archive is extracted directly under the web root and becomes immediately executable over HTTP without the plugin ever being enabled. The /plugins/install-url route additionally allows the archive to be sourced from any attacker-controlled HTTPS URL, validated only against an attacker-supplied SHA-256 hash. No public exploit identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management application (CPE cpe:2.3:a:churchcrm:crm). The flaw is a classic CWE-434 Unrestricted Upload of File with Dangerous Type: the plugin installer's extension-filtering logic is inverted in effect - the allow-list intentionally contains 'php' and the corresponding deny-list does not neutralize ordinary .php files, so the two controls that should block executable content instead permit it. The plugin ZIP is unpacked into a directory beneath the document root that the PHP interpreter serves and executes, meaning extracted code runs in the web server's request context. The install-url path (management.php → /plugins/install-url) compounds this by fetching the ZIP from an arbitrary HTTPS location and checking integrity only against a hash the same actor supplies, so the hash check provides no security value against a malicious operator.

RemediationAI

Vendor-released patch: upgrade to ChurchCRM 7.4.0, which corrects the plugin extension handling; this is the primary and recommended fix (see GHSA-37mf-vq43-5qp9 at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-37mf-vq43-5qp9). Where immediate upgrade is not possible, reduce exposure by restricting who holds administrator accounts and enforcing strong, unique credentials plus MFA on the admin panel, since exploitation requires admin access. As a compensating control, block or restrict access to the plugin management functionality (the /plugins/install-url and plugin-install routes in management.php) at the web server or reverse proxy so plugins cannot be installed from remote URLs - the trade-off is that legitimate plugin installation is disabled until re-enabled. Additionally, configure the web/application server so the plugin extraction directory under the web root cannot execute PHP (for example, disable the PHP handler for that path) - the trade-off is that any plugin legitimately relying on server-side PHP in that location will stop functioning. Egress filtering to prevent the server from fetching arbitrary attacker HTTPS URLs further limits the install-url vector.