# CVE-2026-39337: ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code…

Source: https://junglewise.ai/threats/cve-2026-39337-churchcrm-is-an-open-source-church-management-system-prior-to-7-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07  
License: CC BY 4.0 with a link back

CVE-2026-39337 · Severity: critical · CVSS 10 · Published 2026-04-07

ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.

Technologies: [ChurchCRM](https://junglewise.ai/threats/technologies/churchcrm). Vendors: [ChurchCRM](https://junglewise.ai/threats/vendors/churchcrm).

## Quick answers

**Is CVE-2026-39337 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39337 being exploited in the wild.

**How severe is CVE-2026-39337?** Critical severity, with a CVSS score of 10, published 7 April 2026.

**Which products and versions are affected?** ChurchCRM. The advisory does not name versions.

**Is there a fix for CVE-2026-39337?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-39337?** Check whether you run ChurchCRM. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- ChurchCRM

## Related threats

- [ChurchCRM CRM authorization bypass in family-scoped endpoints](https://junglewise.ai/threats/cve-2026-58410-churchcrm-crm-authorization-bypass-in-family-scoped-endpoints)
- [ChurchCRM unrestricted file upload in plugin installer](https://junglewise.ai/threats/cve-2026-58409-churchcrm-unrestricted-file-upload-in-plugin-installer)
- [ChurchCRM broken access control in CSVCreateFile.php export](https://junglewise.ai/threats/cve-2026-58408-churchcrm-broken-access-control-in-csvcreatefile-php-export)
- [ChurchCRM CSRF in legacy delete endpoints](https://junglewise.ai/threats/cve-2026-44548-churchcrm-csrf-in-legacy-delete-endpoints)
- [ChurchCRM 2FA and account lockout bypass in public API login](https://junglewise.ai/threats/cve-2026-44547-churchcrm-2fa-and-account-lockout-bypass-in-public-api-login)