In ChurchCRM versions before 7.2.0 a family record deletion workflow in SelectDelete.php accepts a plain GET request without CSRF token validation, allowing a malicious page to silently delete family records and all related details, including notes, pledges, persons and property data. The deletion is irreversible, leading to total loss of both structured data and contextual information owned by an administrator’s organization. The flaw stems from missing CSRF protection and insufficient authorization checks, allowing any authenticated administrator to trigger these destructive actions without interaction.

ChurchCRM:CRM applications running any build older than version 7.2.0 are affected. No other vendors or product lines are listed. Exact patches start at 7.2.0 where the issue is remedied.

The CVSS base score of 8.1 marks this as a high‑severity vulnerability, while the EPSS score is not published and it is not in the CISA KEV catalog. A threat actor can exploit the flaw remotely by hosting a malicious webpage that causes an authenticated administrator’s browser to make the vulnerable GET request; no user interaction beyond navigation to the page is required. The impact is data loss, and the risk is considerable given the ease of exploitation and the strong damages to the affected organization.