CVE-2026-61983
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Church Admin WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.0.30.
Risk Assessment
An attacker can gain unauthorized access to administrative functions of the plugin, potentially leading to data modification, privilege escalation, or site takeover.
Recommendation
Immediately update the Church Admin plugin to the latest available version that fixes this vulnerability. If no update is available, consider temporarily disabling the plugin.
Other vulnerabilities in Church Admin
See all- CVE-2026-66478Critical
The Church Admin plugin versions up to 5.1.1 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.
- CVE-2026-94421Medium
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to and including 5.1.2. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with subscriber-level access and above to inject scripts.
Original NVD description (English source)
Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS