What is the CVSS score of CVE-2026-66478?

CVE-2026-66478 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Church Admin are affected by CVE-2026-66478?

An unauthenticated SQL injection vulnerability in Church Admin WordPress plugin (CVE-2026-66478, CVSS 9.3) allows attackers to remotely access WordPress databases without credentials or login.

How to fix or mitigate CVE-2026-66478?

Within 24 hours: Identify all WordPress installations running Church Admin plugin versions through 5.1.1 and immediately disable the plugin if operational alternatives exist; conduct forensic review of database access logs for signs of exploitation. Within 7 days: Deploy Web Application Firewall rules to block SQL injection attack signatures against vulnerable endpoints, restrict database user permissions to least-privilege scope, and implement real-time database activity monitoring. Within 30 days: Establish continuous monitoring of vendor security advisories for patch availability; if patch remains unavailable, execute migration to an actively maintained plugin alternative or replace functionality through custom development.

Church Admin CVE-2026-66478

EUVD-2026-57891 CRITICAL

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-qc76-7cx7-6pgf

WordPress SQLi Church Admin Wordpress Plugin Andy Moyle

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated network SQLi needing no interaction (AV:N/AC:L/PR:N/UI:N) yields high confidentiality via database read; I and A left N absent evidence of write/DoS, and scope kept Unchanged conservatively.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:30 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.

AnalysisAI

Unauthenticated SQL injection in the Church Admin WordPress plugin (all versions through 5.1.1) lets remote attackers inject SQL through an unauthenticated request, exposing the WordPress database without any login. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, no-privilege network exploitation, and the CWE-89 root cause plus scope-change flag point to database compromise reaching beyond the plugin itself. No public exploit identified at time of analysis, but the low complexity and zero-authentication profile make it a strong candidate for opportunistic scanning.

Technical ContextAI

Church Admin is a WordPress plugin by developer Andy Moyle (CPE cpe:2.3:a:andy_moyle:church_admin) used for church membership, event, and giving management on WordPress sites. The flaw is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controlled input is concatenated into a SQL query executed against the shared WordPress/MySQL database without proper parameterization or sanitization. Because WordPress plugins run inside the CMS but query a distinct database backend, Patchstack's assigned vector marks Scope:Changed, reflecting that a successful injection impacts the database component beyond the plugin's own security authority.

RemediationAI

No vendor-released patch version was identified in the available data, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-1-1-sql-injection-vulnerability) and the WordPress.org plugin changelog to obtain and install the first release above 5.1.1 as soon as it is confirmed. Until a fixed version is applied, the most effective compensating control is a Web Application Firewall (WAF) rule set - Patchstack's own virtual patching, or generic SQLi signatures in Wordfence/Cloudflare/ModSecurity - to block injection payloads against the plugin's endpoints, accepting that WAF rules can be bypassed and are not a substitute for patching. Where the plugin's public-facing features are not essential, deactivating and removing Church Admin eliminates the exposure entirely at the cost of losing church-management functionality; if it must stay active, restrict access to its request handlers at the web-server or reverse-proxy layer and monitor database query logs for anomalous statements.