CVE-2026-0682
BaseFortify
Publication date: 2026-01-17
Last updated on: 2026-01-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| church_admin | church_admin | to 5.0.28 (inc) |
| church_admin | church_admin | 5.0.29 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability is a Server-Side Request Forgery (SSRF) in the Church Admin WordPress plugin affecting all versions up to and including 5.0.28. It occurs because the plugin does not properly validate user-supplied URLs in the 'audio_url' parameter. This allows authenticated attackers with Administrator-level access to make web requests from the web application to arbitrary locations, potentially querying or modifying information on internal services.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with Administrator privileges to make the server perform HTTP requests to arbitrary locations, including internal network services that are not normally accessible externally. This can lead to unauthorized access or modification of internal data, potentially exposing sensitive information or affecting internal systems.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the Server-Side Request Forgery vulnerability in the Church Admin WordPress plugin (CVE-2026-0682), you should update the plugin to a version later than 5.0.28, as all versions up to and including 5.0.28 are vulnerable. Additionally, restrict Administrator-level access to trusted users only, since the vulnerability requires authenticated Administrator privileges. Applying the latest security patches and following best practices for user permissions will help reduce risk. [5]