The vulnerability in ChurchCRM allows attackers to execute arbitrary PHP code during the initial setup wizard. Because the $dbPassword variable is not sanitized, an unauthenticated user can inject malicious scripts, leading to full control over the web server. The identified weakness corresponds to unsanitized code injection, classified as CWE‑94.

ChurchCRM version 7.0.x and earlier are affected. The issue was addressed in release 7.1.0. Any deployment of ChurchCRM before this patch that exposes the setup wizard is vulnerable.

The CVSS score of 10 indicates critical severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not yet listed in the CISA KEV catalog, but its nature allows attackers who can reach the installation page to run code without authentication, potentially leading to remote attacks. Because the exploit requires only web access to the setup wizard and no credential, the attack vector is network‑based and unauthenticated.