An authenticated remote code execution vulnerability in ChurchCRM allows an administrator to execute arbitrary PHP code by uploading a malicious plugin, resulting in full system compromise.

This is an unrestricted file upload vulnerability (CWE-434) where the application fails to effectively block PHP files in plugin archives. An attacker with administrative privileges can upload a ZIP file containing a webshell, which becomes immediately executable due to improper directory permissions and extension handling.

While this exploit requires authenticated administrative access (PR:H), the impact is critical (CVSS 9.1) because it grants the attacker full control over the application server. This could lead to complete data exfiltration, modification of sensitive church membership records, and potential use of the server as a pivot point for further attacks.

Immediate Action: Update ChurchCRM CRM to version 7.4.0 or later immediately to resolve the flawed extension validation logic.

Proactive Monitoring: Audit existing installed plugins for unauthorized files and review server logs for suspicious access to newly uploaded files within the web root.

Compensating Controls: Restrict access to the administrative dashboard to trusted IP addresses and enforce strict file system permissions to prevent the execution of scripts in the plugin upload directory.

Public Exploit Available: Unknown

Organizations using ChurchCRM must prioritize upgrading to version 7.4.0. Given the sensitivity of the data typically managed by church management systems, ensuring that administrative accounts are secured and software is patched is essential to maintaining institutional security.