CVE-2026-39342
Published: 07 April 2026
Summary
CVE-2026-39342 is a critical-severity SQL Injection (CWE-89) vulnerability in Churchcrm Churchcrm. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-39342 is a SQL injection vulnerability (CWE-89) in ChurchCRM, an open-source church management system. Versions prior to 7.1.0 are affected, specifically through the searchwhat parameter in QueryView.php when QueryID=15 is used.
An authenticated user with access to Data/Reports > Query Menu and the "Advanced Search" query can exploit this remotely with low attack complexity and no user interaction. Exploitation enables high impacts on confidentiality, integrity, and availability, as reflected in the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), potentially allowing arbitrary SQL query execution.
The issue is addressed in ChurchCRM 7.1.0. Additional details are available in the GitHub security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-7fr4-mvfm-cxfx.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19845
Vulnerability details
ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL injection. The authenticated user requires access to Data/Reports > Query Menu and access to the "Advanced Search"…
more
query. This vulnerability is fixed in 7.1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in web app enables exploitation of public-facing applications via remote arbitrary SQL execution; directly facilitates data collection from databases.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs such as the searchwhat parameter to directly prevent SQL injection exploitation.
SI-2 mandates timely identification, reporting, and correction of flaws like the SQL injection vulnerability addressed in ChurchCRM 7.1.0.
RA-5 employs vulnerability scanning to identify SQL injection vulnerabilities such as CVE-2026-39342 in the QueryView.php component.