External risk intelligence

Church Admin SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-66478

The vulnerability affects a WordPress plugin, which is a type of web application component typically deployed as part of a public-facing website. Plugins like these are intended to be accessible to site visitors and users over the internet, making the vulnerable code path commonly reachable from the public web.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an unauthenticated SQL injection vulnerability identified in the Church Admin software. The issue allows unauthorized access to manipulate the application's database. The main concern is confirming relevance and exposure.

Unauthenticated database access vulnerability found.
Affects widely used web application components.
Assess for any potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network to a website using the affected plugin. This bypasses authentication and directly targets a function within the plugin that is susceptible to SQL injection. Successfully triggering this flaw could allow the attacker to access or manipulate sensitive database information.

No authentication required.
Send malicious database queries.
Read sensitive database information.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated SQL injection vulnerability in Church Admin could allow an attacker to access and potentially modify sensitive data stored in the application's database. This could occur when the application improperly handles user-supplied input within SQL queries, leading to unauthorized database operations. The impact depends on the specific database schema and the privileges of the application's database user.

Database records could be exposed.
Malicious SQL queries could be injected.
Data integrity may be compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Church Admin affects unauthenticated SQL injection, likely impacting organizations with public-facing websites utilizing this plugin. Infrastructure and platform teams responsible for web application hosting should collaborate with security teams to identify all instances of the affected technology. The immediate priority is to confirm exposure, assess business criticality, and then plan remediation based on risk, potentially involving vendor coordination or temporary risk reduction measures until a permanent fix can be applied.

Identify and triage affected instances.
Verify external reachability and business impact.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Church Admin plugin?

Church Admin is a WordPress plugin designed to help religious organizations manage their daily operations. It typically handles member databases, event scheduling, and group communications within a WordPress-powered website, essentially acting as a specialized content management extension.

What does SQL injection mean for CVE-2026-66478?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. It means the software does not properly filter data provided by a user before including it in a database query. Because of this, an attacker can input their own database commands to trick the system into revealing or modifying information it should keep private.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specifically crafted network requests to a site running the affected plugin. Because the vulnerability is unauthenticated, no login or special user privileges are required. It is important to note that simply visiting the site normally will not trigger this; the attacker must intentionally send malicious, structured data designed to exploit the poorly handled input fields.

Is my website at risk from this CVE?

According to Halo Surface Signal, this vulnerability is likely to affect you if your website is public-facing. Because this is a WordPress plugin, its functions are often designed to be reachable over the internet to serve site visitors. If your site is hosted on the public web and uses an affected version of Church Admin, it is theoretically reachable by an attacker.

What should I do if I use Church Admin?

First, verify which version of the plugin is currently installed on your WordPress site. If you are running version 5.1.1 or older, you should prioritize checking for official updates from the vendor. While preparing to update, assess what sensitive data is stored in your database to understand your risk, and work with your site administrators to restrict unauthorized access to your hosting environment.

References

patchstack.com/database/wordpress/plugin/church-admin/vulnerability/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.