What is the CVSS score of CVE-2026-61983?

CVE-2026-61983 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Church Admin CVE-2026-61983

EUVD-2026-43320 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Church Admin Wordpress Plugin Andy Moyle

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no auth or complexity required (AV:N, AC:L, PR:N, UI:N); only limited unauthorized writes possible, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:21 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30.

AnalysisAI

Missing authorization in the Church Admin WordPress plugin (versions through 5.0.30) allows unauthenticated remote attackers to invoke plugin endpoints and perform unauthorized write operations without authentication. The root cause is incorrectly configured access control security levels (CWE-862), where certain plugin actions omit the required capability or nonce checks. No public exploit code or active exploitation has been identified at time of analysis, though the zero-barrier CVSS vector (PR:N, AC:L, AV:N) means opportunistic abuse is technically straightforward for any attacker who can reach the WordPress instance.

Technical ContextAI

The affected product is the Church Admin WordPress plugin by andy_moyle (CPE: cpe:2.3:a:andy_moyle:church_admin:*:*:*:*:*:*:*:*), covering all releases up to and including version 5.0.30. CWE-862 (Missing Authorization) indicates that one or more plugin-registered actions - likely WordPress admin-ajax handlers or REST API endpoints - execute privileged operations without verifying the requesting party's capabilities or validating a security nonce. WordPress plugins are expected to check current_user_can() or validate nonces before performing sensitive writes; omitting these checks exposes the action to any party who can craft the appropriate HTTP request. Patchstack classifies this as a Broken Access Control / Authentication Bypass scenario, consistent with the CVSS PR:N signal.

RemediationAI

No vendor-released patched version has been independently confirmed from available data. Administrators running Church Admin 5.0.30 or earlier should monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-0-30-broken-access-control-vulnerability) and the WordPress.org plugin changelog for an updated release. As a compensating control, temporarily deactivating the Church Admin plugin eliminates the attack surface entirely if church management functionality is non-critical; note this disables all plugin features. Alternatively, a web application firewall rule restricting unauthenticated access to the site's admin-ajax.php endpoint and custom REST routes can reduce exposure, though overly broad rules may break other plugins that legitimately serve unauthenticated users. Patchstack subscribers may apply virtual patching for interim protection.