Description

Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-13T14:17:08.763Z",
  "pubdate": "2026-08-13T14:17:08.763Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified in the Church Admin plugin affecting versions 5.1.1 and prior. This security flaw allows remote, unauthenticated threat actors to manipulate database queries by injecting arbitrary SQL commands through vulnerable input parameters. Successful exploitation of this vulnerability can lead to unauthorized data exfiltration, sensitive information disclosure, database manipulation, and potentially complete compromise of the underlying WordPress database. The vulnerability poses a severe risk to confidentiality, integrity, and availability. Exploitation requires network access to the target WordPress installation and does not necessitate any prior authentication or administrative privileges, significantly lowering the attack barrier for malicious actors targeting affected Church Admin deployments.",
  "technicalDetails": "The vulnerability stems from improper neutralization of user-supplied input prior to its inclusion in database queries, violating secure coding practices regarding SQL construction. Specifically, the Church Admin plugin fails to adequately sanitize or parameterize input parameters processed by its backend functions in versions <= 5.1.1. This architectural flaw allows an attacker to inject malicious SQL syntax directly into database operations executed via PHP and the WordPress database abstraction layer ($wpdb). The attack flow begins when an unauthenticated remote attacker crafts an HTTP request containing malicious SQL payloads directed toward an exposed vulnerable endpoint within the plugin. Upon receipt, the application processes the input without proper type enforcement, sanitization, or prepared statements, causing the injected SQL commands to be executed directly by the backend database management system. Depending on the database configuration and application logic, attackers can leverage techniques such as UNION-based SQL injection, error-based extraction, or blind boolean/time-based inference to harvest sensitive information, including user credentials, administrative session tokens, and personally identifiable information stored within the WordPress database. Furthermore, this vulnerability exposes the system to potential database-level modifications, including the creation of rogue administrator accounts or the execution of database-level administrative commands depending on database user privileges."
}