CVE-2026-0682 – The Church Admin WordPress plugin is vulnerable... (How to Fix)

📋 TL;DR

The Church Admin WordPress plugin is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to 5.0.28. This allows authenticated attackers with Administrator access to make arbitrary web requests from the vulnerable server, potentially accessing internal services. Only WordPress sites using vulnerable versions of the Church Admin plugin are affected.

💻 Affected Systems

Products:

Church Admin WordPress Plugin

Versions: All versions up to and including 5.0.28

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated Administrator access to exploit

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Administrator-level attacker could access internal services, exfiltrate sensitive data, or perform internal network reconnaissance leading to further compromise.

🟠

Likely Case

Malicious administrator could probe internal network services, potentially accessing metadata services or internal APIs.

🟢

If Mitigated

With proper network segmentation and least privilege, impact is limited to the web server's network perspective.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires Administrator-level access to WordPress

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 5.0.28

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440847%40church-admin&new=3440847%40church-admin&sfp_email=&sfph_mail=

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Church Admin plugin
4. Click 'Update Now' if update available
5. Alternatively, download latest version from WordPress plugin repository

🔧 Temporary Workarounds

Remove Administrator Access

all

Restrict Administrator access to trusted users only

Disable Plugin

all

Temporarily disable Church Admin plugin until patched

🧯 If You Can't Patch

Implement network segmentation to restrict web server access to internal services
Apply strict firewall rules to limit outbound connections from web server

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Church Admin version. If version is 5.0.28 or lower, system is vulnerable.

Check Version:

wp plugin list --name=church-admin --field=version (if WP-CLI installed)

Verify Fix Applied:

Verify Church Admin plugin version is higher than 5.0.28 in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual outbound HTTP requests from web server to internal IP ranges
Multiple failed connection attempts to internal services

Network Indicators:

HTTP requests from web server to internal services not typically accessed
Traffic to metadata services (169.254.169.254 for AWS, etc.)

SIEM Query:

source="web_server_logs" AND (dst_ip IN internal_ranges OR dst_ip=169.254.169.254) AND user_agent="WordPress"

📊 Metadata

CVE ID: CVE-2026-0682

CVSS v3 Score: 2.2 (LOW)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

CWE: CWE-918

EPSS Score: 0.04% exploit probability (11.2th percentile)

Published: January 17, 2026

Last Updated: January 26, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-0682, you might also want to check these: