External risk intelligence

Mojoomla WPCHURCH Blind SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-32303

This vulnerability affects a WordPress plugin, which is a type of web application component. WordPress plugins are commonly deployed as part of public-facing web applications, making the vulnerable code directly accessible via the internet as part of the standard web application surface.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical SQL injection vulnerability impacting a plugin used in certain WordPress installations. The flaw could potentially allow unauthorized access to sensitive data if exploited. The main concern is confirming whether this plugin is in use and, if so, assessing its relevance.

Flaw allows unauthorized access to data.
Affects a web plugin commonly used online.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker could send specially crafted data over the network to a vulnerable WordPress plugin. This could allow them to interfere with how the plugin processes SQL commands, potentially leading to unauthorized access to database information or disruption of the application.

No authentication is required.
Triggered by sending malicious SQL commands.
Risk of unauthorized database access.

Live Threat

Current exploitation, exposure, and threat context

A blind SQL injection vulnerability in WPCHURCH could allow an unauthenticated attacker to infer information about the underlying database when supported by the advisory. This could potentially lead to the disclosure of sensitive data stored within the application.

Database information could be exposed.
Via specially crafted SQL queries.
Leading to potential data leakage.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in WPCHURCH, affecting versions up to 2.7.0, is likely exposed externally and accessible via the network. The first practical step is for the application owner or platform team to identify all instances of WPCHURCH, determine their business criticality and network reachability, and then coordinate with the vendor or security team for remediation planning.

Application owners should take primary responsibility.
Verify all WPCHURCH instances are identified.
Plan remediation based on business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Mojoomla WPCHURCH plugin used for?

WPCHURCH is a WordPress plugin designed to help religious organizations manage their community operations. It typically functions as a component within a WordPress site, handling backend data tasks that allow administrators to organize content or member information.

What does SQL injection mean for CVE-2025-32303?

This CVE involves a weakness categorized as CWE-89, or improper neutralization of special elements in SQL commands. Essentially, the plugin fails to properly filter user input before processing it as a database command. An attacker can leverage this to 'inject' their own queries, allowing them to communicate with the database in unauthorized ways and potentially extract information bit by bit.

How is this WPCHURCH vulnerability triggered?

An attacker triggers this flaw by sending specially crafted data over the network to the plugin. Because it is a blind injection, the attacker does not see a direct output but instead infers database contents based on how the application responds. Note that this flaw is not triggered by standard site usage or legitimate administrative configuration; it specifically requires the transmission of malicious, structured SQL-like payloads.

Is my installation at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a 'Likely' risk because WPCHURCH is a web application component. Since WordPress plugins are almost always deployed on public-facing websites, the vulnerable code is usually reachable from the internet, increasing the likelihood that it is accessible to external actors who do not have prior system access.

What should I do if I run WPCHURCH?

First, inventory your web environment to confirm if the plugin is installed and which version is active. If you are running version 2.7.0 or earlier, treat the component as vulnerable. Your next step is to coordinate with your security or development team to prioritize this item for update or removal based on the sensitivity of the data stored within that specific WordPress instance.

References

patchstack.com/database/wordpress/plugin/church-management/vulnerabi…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.