CVE-2026-66478
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The Church Admin plugin versions up to 5.1.1 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.
Risk Assessment
An attacker can read, modify, or delete data from the database, potentially leading to confidentiality, integrity, and availability breaches. This may also enable takeover of administrator accounts or the entire site.
Recommendation
Update the Church Admin plugin to the latest version that includes the fix. If not available, immediately restrict access to the plugin and monitor database logs for suspicious queries.
Other vulnerabilities in Church Admin
See all- CVE-2026-94421Medium
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to and including 5.1.2. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with subscriber-level access and above to inject scripts.
- CVE-2026-61983Medium
The Church Admin WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.0.30.
Original NVD description (English source)
Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS