Andy Moyle
Monthly
Unauthenticated SQL injection in the Church Admin WordPress plugin (all versions through 5.1.1) lets remote attackers inject SQL through an unauthenticated request, exposing the WordPress database without any login. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, no-privilege network exploitation, and the CWE-89 root cause plus scope-change flag point to database compromise reaching beyond the plugin itself. No public exploit identified at time of analysis, but the low complexity and zero-authentication profile make it a strong candidate for opportunistic scanning.
Missing authorization in the Church Admin WordPress plugin (versions through 5.0.30) allows unauthenticated remote attackers to invoke plugin endpoints and perform unauthorized write operations without authentication. The root cause is incorrectly configured access control security levels (CWE-862), where certain plugin actions omit the required capability or nonce checks. No public exploit code or active exploitation has been identified at time of analysis, though the zero-barrier CVSS vector (PR:N, AC:L, AV:N) means opportunistic abuse is technically straightforward for any attacker who can reach the WordPress instance.
Cross-Site request forgery (CSRF) vulnerability in Andy Moyle Emergency Password Reset allows Cross Site Request Forgery.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated SQL injection in the Church Admin WordPress plugin (all versions through 5.1.1) lets remote attackers inject SQL through an unauthenticated request, exposing the WordPress database without any login. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, no-privilege network exploitation, and the CWE-89 root cause plus scope-change flag point to database compromise reaching beyond the plugin itself. No public exploit identified at time of analysis, but the low complexity and zero-authentication profile make it a strong candidate for opportunistic scanning.
Missing authorization in the Church Admin WordPress plugin (versions through 5.0.30) allows unauthenticated remote attackers to invoke plugin endpoints and perform unauthorized write operations without authentication. The root cause is incorrectly configured access control security levels (CWE-862), where certain plugin actions omit the required capability or nonce checks. No public exploit code or active exploitation has been identified at time of analysis, though the zero-barrier CVSS vector (PR:N, AC:L, AV:N) means opportunistic abuse is technically straightforward for any attacker who can reach the WordPress instance.
Cross-Site request forgery (CSRF) vulnerability in Andy Moyle Emergency Password Reset allows Cross Site Request Forgery.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.