CVE-2026-61983

MediumCVSS 5.3

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

The Church Admin WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.0.30.

Risk Assessment

An attacker can gain unauthorized access to administrative functions of the plugin, potentially leading to data modification, privilege escalation, or site takeover.

Recommendation

Immediately update the Church Admin plugin to the latest available version that fixes this vulnerability. If no update is available, consider temporarily disabling the plugin.

Other vulnerabilities in Church Admin

CVE-2026-66478Critical
The Church Admin plugin versions up to 5.1.1 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.

Original NVD description (English source)

Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS