CVE-2026-125792: WordPress Church Admin plugin <= 5.1.8 - Broken Access Control vulnerability
Published Nov 13, 2026
·Updated
Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8.
Affected Software
1 affected component
wordpress/church-admin<=5.1.8
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/church-adminto a version that resolves this vulnerability.Fixed in 5.1.9
Event History
Nov 13, 2026
CVE Published
via MITRE·02:44 PM
Data Sourced
via MITRE·02:44 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is remotely exploitable without authentication or user interaction, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N.
2
What is the likely impact if exploitation succeeds?
The reported impact is limited to availability. The CVSS vector indicates no confidentiality or integrity impact and a low availability impact.
3
Which Church Admin versions are affected?
Church Admin versions through 5.1.8 are affected. The provided data does not identify a fixed version.