# CVE-2026-58409: ChurchCRM unrestricted file upload in plugin installer

Source: https://junglewise.ai/threats/cve-2026-58409-churchcrm-unrestricted-file-upload-in-plugin-installer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-58409 · Severity: critical · CVSS 9.1 · Published 2026-07-13

ChurchCRM is an open-source management system used by churches to handle member data, financial records, and donations. A security flaw allows an administrator to upload a malicious plugin that can take complete control of the underlying server. If exploited, an attacker could steal sensitive member information, access financial records, or disrupt church operations.

Technologies: [ChurchCRM](https://junglewise.ai/threats/technologies/churchcrm). Vendors: [ChurchCRM](https://junglewise.ai/threats/vendors/churchcrm).

## Quick answers

**Is CVE-2026-58409 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58409 being exploited in the wild.

**How severe is CVE-2026-58409?** Critical severity, with a CVSS score of 9.1, published 13 July 2026.

**Which products and versions are affected?** ChurchCRM < 7.4.0.

**Is there a fix for CVE-2026-58409?** A patch was published on 2026-06-18: Fixed in version 7.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58409 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58409?** Check whether you run ChurchCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A remote code execution (RCE) vulnerability exists in ChurchCRM's plugin installation mechanism due to unrestricted file upload (CWE-434). The application's `PluginInstaller.php` explicitly includes 'php' in its `ALLOWED_EXTENSIONS` list and fails to block standard PHP extensions in its denylist. An authenticated administrator can use the `/plugins/install-url` API route to source a malicious ZIP archive from a remote URL. Because the application extracts these files directly into the web root, any PHP webshell included in the archive becomes immediately executable via HTTP. This issue is resolved in version 7.4.0, which implements a dangerous extension blocklist and a new plugin vetting process.

## Affected products

- ChurchCRM ChurchCRM < 7.4.0

## Timeline

- 2026-06-18: patched: Fixed in version 7.4.0
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-13: disclosed: NVD publication date

## References

- [https://github.com/ChurchCRM/CRM/security/advisories/GHSA-37mf-vq43-5qp9](https://github.com/ChurchCRM/CRM/security/advisories/GHSA-37mf-vq43-5qp9)

## Related threats

- [ChurchCRM CRM authorization bypass in family-scoped endpoints](https://junglewise.ai/threats/cve-2026-58410-churchcrm-crm-authorization-bypass-in-family-scoped-endpoints)
- [ChurchCRM broken access control in CSVCreateFile.php export](https://junglewise.ai/threats/cve-2026-58408-churchcrm-broken-access-control-in-csvcreatefile-php-export)
- [ChurchCRM CSRF in legacy delete endpoints](https://junglewise.ai/threats/cve-2026-44548-churchcrm-csrf-in-legacy-delete-endpoints)
- [ChurchCRM 2FA and account lockout bypass in public API login](https://junglewise.ai/threats/cve-2026-44547-churchcrm-2fa-and-account-lockout-bypass-in-public-api-login)
- [ChurchCRM CSRF in UserEditor.php leads to privilege escalation](https://junglewise.ai/threats/cve-2026-42289-churchcrm-csrf-in-usereditor-php-leads-to-privilege-escalation)