Remote Code Execution in ChurchCRM via Malicious Plugin

Executive Summary

CVE-2026-58409 is a vulnerability in ChurchCRM, an open-source church management system. Before version 7.4.0, an authenticated administrator can execute remote code (RCE) on the server by installing a malicious plugin ZIP archive.

The vulnerability arises because the application allows PHP files in plugin archives, as 'php' is explicitly listed in the ALLOWED_EXTENSIONS. Meanwhile, the DENIED_EXTENSIONS list does not block standard .php files. When a plugin ZIP is extracted, its contents are placed directly under the web root, making any PHP file inside immediately executable via HTTP without requiring the plugin to be enabled in the UI.

Additionally, the /plugins/install-url API route (management.php) lets an administrator install a plugin from any attacker-controlled HTTPS URL. The validation is done only against an attacker-supplied SHA-256 hash, which does not prevent exploitation.

This issue was fixed in version 7.4.0 of ChurchCRM.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can check for the presence of unauthorized or suspicious PHP files in the ChurchCRM plugin directory. Since the vulnerability allows an authenticated administrator to install a malicious plugin ZIP archive containing a PHP webshell, you should inspect the plugin installation directory for unexpected or recently added PHP files.

• Check the ChurchCRM plugin directory for unexpected PHP files. The default plugin directory is typically located under the web root (e.g., /var/www/html/plugins or /usr/share/nginx/html/plugins). Use the following command to list PHP files in the plugin directory: ls -la /path/to/churchcrm/plugins/*.php
• Review the ChurchCRM plugin installation logs or database for recently installed plugins. Look for plugins that were installed outside of normal maintenance windows or by unfamiliar administrators.
• Monitor network traffic for unusual outbound connections from the ChurchCRM server, particularly to external HTTPS URLs that may have been used to fetch malicious plugin ZIP archives.
• Verify the version of ChurchCRM installed on your system. If the version is prior to 7.4.0, it is vulnerable. Use the following command to check the version if it is accessible via the application's interface or configuration files: grep -i 'version' /path/to/churchcrm/config.php

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of ChurchCRM (prior to 7.4.0), this vulnerability could have severe consequences:

• An authenticated administrator with malicious intent could execute arbitrary code on your server, leading to full system compromise.
• Attackers could gain unauthorized access to sensitive data stored in the ChurchCRM system, such as member information, financial records, or other confidential details.
• The server could be used as a pivot point for further attacks within your network, potentially compromising other systems.
• The integrity of your ChurchCRM installation could be compromised, leading to data manipulation, deletion, or unauthorized modifications.
• The availability of your ChurchCRM system could be disrupted if the attacker decides to delete or corrupt critical files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can significantly impact compliance with various standards and regulations, depending on the type of data your ChurchCRM system handles:

• GDPR (General Data Protection Regulation): If your ChurchCRM system processes personal data of EU citizens, a breach resulting from this vulnerability could lead to unauthorized access or disclosure of personal data. This would constitute a data breach under GDPR, requiring notification to authorities and affected individuals. Non-compliance could result in significant fines (up to 4% of global annual revenue or €20 million, whichever is higher).
• HIPAA (Health Insurance Portability and Accountability Act): If your ChurchCRM system stores or processes protected health information (PHI) in the U.S., exploitation of this vulnerability could lead to unauthorized access to PHI. This would be considered a breach under HIPAA, requiring notification to affected individuals, the Department of Health and Human Services, and potentially the media. Non-compliance could result in substantial fines and corrective action plans.
• Other data protection regulations: Depending on your jurisdiction, similar regulations (e.g., CCPA in California, PIPEDA in Canada) may also be impacted. Unauthorized access to personal or sensitive data could lead to legal and financial consequences.

Beyond regulatory fines, a breach could damage your organization's reputation, erode trust with members or stakeholders, and lead to potential lawsuits or other legal actions.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade ChurchCRM to version 7.4.0 or later, as this version includes the fix for the vulnerability. This is the most effective way to address the issue.
• If upgrading is not immediately possible, restrict access to the /plugins/install-url API route (management.php) to prevent unauthorized plugin installations. This can be done by modifying the web server configuration (e.g., Apache or Nginx) to block access to this endpoint.
• Audit the plugin directory for any suspicious or unauthorized PHP files. Remove any files that are not part of legitimate plugins. Use the following command to identify PHP files in the plugin directory: find /path/to/churchcrm/plugins -name "*.php" -type f
• Review administrator accounts and permissions to ensure no unauthorized users have administrative access. Reset passwords for all administrator accounts as a precaution.
• Monitor the ChurchCRM server for signs of compromise, such as unusual processes, network connections, or file modifications. Use tools like netstat, ps, and file integrity monitoring to detect anomalies.

Useful 0 Not Useful 0