CVE-2026-66478

The Church Admin plugin versions up to 5.1.1 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.

An attacker can read, modify, or delete data from the database, potentially leading to confidentiality, integrity, and availability breaches. This may also enable takeover of administrator accounts or the entire site.

Update the Church Admin plugin to the latest version that includes the fix. If not available, immediately restrict access to the plugin and monitor database logs for suspicious queries.