An attacker can send a request to the ChurchCRM application with a malicious Referer header that contains a URL. The CMS then performs an outbound HTTP or HTTPS request to the specified host. This server‑side request forgery (CWE‑918) may allow an adversary to access internal network services, exfiltrate sensitive data, or interact with any remote system reachable from the host running the application. The vulnerability demonstrates a clear threat to confidentiality, integrity, and potentially availability of the application and its underlying infrastructure.

The vulnerability exists in ChurchCRM project versions earlier than 6.5.3. The affected product is the ChurchCRM community edition. No specific sub‑versions are listed, so all releases prior to 6.5.3 are at risk.

The CVSS base score of 7.0 indicates high severity. The EPSS score is below 1%, implying exploit likelihood is low at present, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be via any HTTP request to the application because no authentication requirement is mentioned; thus anonymous users may trigger the SSRF by supplying a crafted Referer header. Exploitation requires only the ability to send a request to the target server and supply a malicious header, after which the application will perform the outbound call.