CVE-2025-32303

WordPress WPCHURCH plugin <= 2.7.0 - SQL Injection Vulnerability

View on CVE.org
Published Jan 7, 2026 CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.

Analysis

AI-generated

Technical impact

WPCHURCH plugin allows blind SQL injection via improper handling of user input, enabling an attacker to read, modify, or delete data from the underlying database. This vulnerability falls under CWE-89 and can compromise confidentiality, integrity, and availability of the site’s data.

Affected Systems

WordPress sites running Mojoomla WPCHURCH plugin versions up to and including 2.7.0 are affected. This includes any installation that has not yet updated beyond version 2.7.0.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity, while the EPSS score of less than 1% suggests a very low but non-zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by sending crafted HTTP requests to the plugin’s endpoints; the description infers that no special privileges are required beyond access to the site’s request handling.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update WPCHURCH to version 2.7.1 or later to apply the vendor patch.
  • If an update is not immediately possible, disable the WPCHURCH plugin so the vulnerable code is no longer exposed.
  • Configure a Web Application Firewall or database access controls to detect and block SQL injection patterns targeting the plugin’s endpoints.

Generated by OpenCVE AI on April 30, 2026 at 14:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH church-management allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through <= 2.7.0. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.
References
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH church-management allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through <= 2.7.0.
References
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.
Title WordPress WPCHURCH plugin <= 2.7.0 - SQL Injection Vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}
Earlier changes (2)
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:12 PM
Reserved
Apr 4, 2025, 10:02 AM

View source JSON

Updated
Jan 7, 2026, 2:24 PM

JSON

Status
Deferred
Published
Jan 7, 2026, 1:15 PM
Modified
Oct 7, 2026, 9:10 AM

View source JSON

No data.

Updated
Apr 30, 2026, 2:30 PM

JSON