PT-2026-40458 · Churchcrm · Churchcrm

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-42288

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.3.2

Description A pre-authentication remote code execution issue exists in the setup wizard. The flaw allows for remote code execution via the unsanitized DB PASSWORD variable.

Recommendations Update to version 7.3.2.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-42288

Affected Products

Churchcrm

References · 6

• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-mp2w-4q3r-ppx7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42288 · Security Note
• https://twitter.com/VulmonFeeds/status/2054386623249289490 · Twitter Post
• https://t.me/CVEtracker/53576 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1tbxqiv/critical_rce_vulnerability_discovered_in · Reddit Post
• https://twitter.com/CVEnew/status/2054340920586178605 · Twitter Post