github.comConfirmation
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pm2v-ggh4-mp7p CVE-2026-39337
CRITICAL
ChurchCRM Affected by Unauthenticated RCE in Install Wizard
Record summary
CVE-2026-39337 has a selected CVSS score of 10.0 (critical).
Description
ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 7, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | < 7.1.0 | affected |