Executive brief
ChurchCRM is an open-source management system used by churches to handle member data, financial records, and donations. A security flaw allows an administrator to upload a malicious plugin that can take complete control of the underlying server. If exploited, an attacker could steal sensitive member information, access financial records, or disrupt church operations.
Technical details
A remote code execution (RCE) vulnerability exists in ChurchCRM's plugin installation mechanism due to unrestricted file upload (CWE-434). The application's `PluginInstaller.php` explicitly includes 'php' in its `ALLOWED_EXTENSIONS` list and fails to block standard PHP extensions in its denylist. An authenticated administrator can use the `/plugins/install-url` API route to source a malicious ZIP archive from a remote URL. Because the application extracts these files directly into the web root, any PHP webshell included in the archive becomes immediately executable via HTTP. This issue is resolved in version 7.4.0, which implements a dangerous extension blocklist and a new plugin vetting process.
Affected products
- ChurchCRM ChurchCRM < 7.4.0
Timeline
- 2026-06-18: patched: Fixed in version 7.4.0
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-13: disclosed: NVD publication date