CVE-2026-39337
CRITICALChurchCRM Affected by Unauthenticated RCE in Install Wizard
Title source: cnaDescription
ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
Scores
CVSS v3
10.0
EPSS
0.0032
EPSS Percentile
55.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-94
Status
published
Products (2)
churchcrm/churchcrm
< 7.1.0
ChurchCRM/CRM
< 7.1.0
Published
Apr 07, 2026
Tracked Since
Apr 08, 2026