The Church Admin plugin for WordPress contains an in‑proper validation flaw in the audio_url parameter that allows a user with Administrator rights to supply any URL. When the plugin processes this input, it issues an HTTP request from the server to the specified address, enabling the attacker to reach internal services or perform write operations against them. This reaches beyond simple data exfiltration and can affect application state or confidential internal resources, but does not result in code execution or privilege escalation outside the web application.

Versions of the Church Admin plugin through and including 5.0.28, released by andy_moyle, are affected. Any WordPress installation running one of these releases is at risk if it contains accounts with Administrator privileges.

The flaw is scored as a low‑severity vulnerability with a very low likelihood of exploitation in practice, and it is not currently listed in the CISA known exploited vulnerabilities catalog. Exploitation requires an authenticated Administrator user, so the threat is confined to sites with such privileged accounts. When used, the attacker can only issue requests from the server to internal resources, which limits the damage compared to higher‑level attacks such as remote code execution.