CVE-2026-0682: Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audiourl' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0682?
CVE-2026-0682 is classified as a moderate severity vulnerability due to its potential for exploitation via Server-Side Request Forgery.
How does CVE-2026-0682 impact Church Admin users?
CVE-2026-0682 allows authenticated users, specifically administrators, to manipulate server requests, leading to unauthorized access to internal resources.
How do I fix CVE-2026-0682?
To fix CVE-2026-0682, update the Church Admin plugin to version 5.0.29 or later, which contains the necessary security patches.
Who is affected by CVE-2026-0682?
CVE-2026-0682 affects all versions of the Church Admin plugin for WordPress up to and including version 5.0.28.
What are the symptoms of exploitation of CVE-2026-0682?
Exploitation of CVE-2026-0682 may result in unexpected behavior of the application, as it could allow unauthorized access to sensitive internal data.