CVE-2025-26941: WordPress Church Admin plugin <= 5.0.18 - SQL Injection vulnerability
Published Mar 26, 2025
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andymoyle Church Admin church-admin allows SQL Injection.This issue affects Church Admin: from n/a through <= 5.0.18.
Affected Software
1 affected component
wordpress/church-admin<=5.0.18
Remediation
Information
Update the WordPress Church Admin wordpress plugin to the latest available version (at least 5.0.19).
Event History
Mar 26, 2025
CVE Published
via MITRE·02:40 PM
Data Sourced
via MITRE·02:40 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-26941?
CVE-2025-26941 has been classified as a high severity SQL Injection vulnerability.
2
How do I fix CVE-2025-26941?
To fix CVE-2025-26941, update the Church Admin plugin to version 5.0.19 or later.
3
What systems are affected by CVE-2025-26941?
CVE-2025-26941 affects Andy Moyle Church Admin versions up to and including 5.0.18.
4
What type of vulnerability is CVE-2025-26941?
CVE-2025-26941 is an SQL Injection vulnerability due to improper neutralization of special elements.
5
Can CVE-2025-26941 lead to data breaches?
Yes, CVE-2025-26941 can allow attackers to manipulate database queries, potentially leading to unauthorized data access.