This vulnerability, identified as CWE-434 (Unrestricted Upload of File with Dangerous type), allows administrators to install plugin archives through an API that accepts a ZIP file from a user‑supplied HTTPS URL. The endpoint validates the file only by comparing it against an SHA‑256 hash provided by the user. The plugin upload mechanism permits the file extension ".php" to be listed as allowed; when the archive is extracted the files are placed directly under the publicly accessible web root, making any PHP file inside the ZIP immediately executable. An attacker who can authenticate as an administrator can therefore upload a ZIP that contains a webshell, cause it to be extracted to the web root, and execute arbitrary code on the server.

The flaw impacts ChurchCRM versions prior to 7.4.0, as identified by the CNA as ChurchCRM:CRM. It applies to all installations that use the default web directory layout, regardless of the underlying operating system or web server, because the issue lies in the PHP code that processes plugin uploads.

The CVSS score of 9.1 reflects the full loss of confidentiality, integrity, and availability that an attacker can achieve if they can authenticate to the application. Because the exploit requires only an authenticated administrator account, it is considered user-facing; if administrative access is exposed over the Internet or the attacker can obtain those credentials, the risk is higher. The vulnerability is not listed in CISA KEV and the EPSS score of 0.00456 indicates a low but non‑zero probability of exploitation. The attack path involves submitting a malicious ZIP to the /plugins/install-url endpoint, which accepts the file, verifies the SHA‑256, extracts it into the web root, and leaves a PHP shell that can be accessed through HTTP.