CVE-2026-39343 ChurchCRM CVE debrief

Who should care

Administrators and users of ChurchCRM versions prior to 7.1.0 should be aware of this SQL injection vulnerability and take steps to mitigate it. This vulnerability requires administrative access to exploit. Operators, platform administrators, and security teams should review the vulnerability and implement necessary mitigations.

Technical summary

The SQL injection vulnerability in ChurchCRM exists in the EditEventTypes.php file. The EN_tyid POST parameter is not properly sanitized before being used in a SQL query, allowing for arbitrary SQL command execution. This vulnerability has a CVSS score of 7.2 and is classified as HIGH severity. The vulnerability is fixed in version 7.1.0. To mitigate, administrators should review and monitor database activity for suspicious queries and restrict access to the EditEventTypes.php file.

Defensive priority

High priority should be given to updating ChurchCRM to version 7.1.0 or later to mitigate this SQL injection vulnerability. Administrators should also review and monitor database activity for suspicious queries and restrict access to the EditEventTypes.php file.

Recommended defensive actions

• Update ChurchCRM to version 7.1.0 or later
• Review and monitor database activity for suspicious queries
• Restrict access to the EditEventTypes.php file
• Implement additional security measures to prevent SQL injection attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-07T18:16:46.437Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. This SQL injection vulnerability exists in ChurchCRM, a church management system, prior to version 7.1.0. The vulnerability is located in the EditEventTypes.php file, which is only accessible to administrators. The EN_tyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute arbitrary SQL commands directly against the database. The vulnerability has a CVSS score of 7.2 and is classified as HIGH severity. To verify, defenders should review the EditEventTypes.php file and check for suspicious database queries.

Official resources