PT-2026-1650 · WordPress · Wpchurch

Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-32303

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions WPCHURCH versions through 2.7.0

Description A flaw exists in WPCHURCH that allows for Blind SQL Injection due to improper neutralization of special elements used in an SQL command. This allows attackers to execute malicious queries. The vulnerability requires no authentication.

Recommendations Update WPCHURCH to a version newer than 2.7.0.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-32303

Affected Products

Wpchurch

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-32303 · Security Note
• https://twitter.com/TheHackerWire/status/2008901459799405038 · Twitter Post
• https://t.me/CVEtracker/41603 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/church-management/vulnerability/wordpress-wpchurch-2-7-0-sql-injection-vulnerability?_s_id=cve · Note
• https://t.me/cveNotify/147925 · Telegram Post
• https://twitter.com/0dayPublishing/status/2008881532509822994 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/church-management/vulnerability/wordpress-wpchurch-2-7-0-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/2008896166839112039 · Twitter Post