PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42288 ChurchCRM CVE debrief

ChurchCRM versions prior to 7.3.2 contain a pre-authentication remote code execution vulnerability in the setup wizard. The vulnerability stems from incomplete remediation of CVE-2026-39337, with the DB_PASSWORD parameter remaining unsanitized and exploitable for code injection. The CVSS 3.1 score of 10.0 reflects network attack vector, low complexity, no privileges required, no user interaction, and changed scope with high impacts to confidentiality, integrity, and availability. The vulnerability was published on May 12, 2026, with the description and metadata last modified on May 18, 2026. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA KEV.

Vendor
ChurchCRM
Product
CRM
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-18
Advisory published
2026-05-12
Advisory updated
2026-05-18

Who should care

Organizations running ChurchCRM church management systems, particularly those with internet-facing installations or multi-site deployments where setup endpoints may remain accessible. Security teams responsible for PHP application security and open-source CRM platforms.

Technical summary

The ChurchCRM setup wizard accepts a DB_PASSWORD parameter without adequate sanitization, allowing injection of executable code. The vulnerability is reachable without authentication, making it exploitable by any network-accessible attacker. The incomplete nature of the prior fix (CVE-2026-39337) suggests the original remediation addressed a symptom or specific payload rather than the underlying input validation deficiency.

Defensive priority

CRITICAL

Recommended defensive actions

  • Upgrade ChurchCRM to version 7.3.2 or later immediately
  • If immediate patching is not possible, restrict network access to the setup wizard endpoints
  • Review and monitor for unauthorized access attempts to /setup paths
  • Verify that no unauthorized administrative accounts were created during potential exploitation windows
  • Conduct forensic review of systems running versions prior to 7.3.2 for signs of compromise

Evidence notes

The vulnerability description explicitly states that the fix for CVE-2026-39337 is incomplete, indicating this is a bypass or insufficient patch scenario rather than a distinct vulnerability class. The CVSS vector confirms full network exploitability without authentication.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42288 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42288

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42288 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42288

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.