An unauthenticated remote code execution vulnerability exists in ChurchCRM’s setup wizard because the DB_PASSWORD input field is not properly sanitized. An attacker can supply crafted input that is executed as code on the server, allowing arbitrary execution before any authentication occurs. The weakness is a classic code injection flaw (CWE‑94).

The vulnerability affects all ChurchCRM installations prior to version 7.3.2. Any instance running a ChurchCRM:CRM product older than 7.3.2 is potentially vulnerable.

With a CVSS score of 10 the risk is critical. The EPSS score is not available, but the vulnerability is publicly documented and the setup wizard is accessible without credentials, making exploitation straightforward. The CVE is not listed in the CISA KEV catalog at this time. An attacker can remotely craft the DB_PASSWORD field to inject code, bypassing authentication entirely.