CVE-2026-44548 - Vulnerability Analysis

Overview

ChurchCRM < 7.3.2 contains a cross-site request forgery caused by top-level cross-site GET navigation to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php, letting attackers cause logged-in users with relevant roles to silently delete records.

Severity & Score

Impact

Attackers can cause deletion of records by tricking logged-in users with relevant roles, leading to data loss and integrity issues.

Mitigation

Update to version 7.3.2 or later.

References

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-jx5r-p82p-2p8m

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner