CVE-2025-39553: Church Admin Auth Bypass Vulnerability

CVE-2025-39553 Overview

CVE-2025-39553 is a Missing Authorization vulnerability [CWE-862] in the Church Admin WordPress plugin by andy_moyle. The flaw affects all versions of church-admin up to and including 5.0.9. An authenticated user with low privileges can access functionality that should be restricted, leading to sensitive data exposure. The issue is network-exploitable, requires low privileges, and does not require user interaction.

Critical Impact

Authenticated attackers with low privileges can access sensitive information managed by the Church Admin plugin due to missing authorization checks on plugin endpoints.

Affected Products

• andy_moyle Church Admin (church-admin) WordPress plugin
• All versions from n/a through 5.0.9
• WordPress sites running the vulnerable plugin

Discovery Timeline

• 2025-09-09 - CVE-2025-39553 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39553

Vulnerability Analysis

The Church Admin plugin exposes functionality without validating whether the requesting user holds the required capabilities. Missing Authorization [CWE-862] occurs when an application performs an action but fails to enforce access controls on the actor. In this case, the plugin returns sensitive data to any authenticated session, regardless of role.

The scope is limited to confidentiality. An attacker cannot modify data or disrupt availability through this flaw alone. However, exposed data can support follow-on attacks such as social engineering, account takeover, or targeting of parishioners and administrators.

Root Cause

The root cause is the absence of capability checks (for example, current_user_can()) or nonce validation on plugin request handlers. WordPress plugins must gate privileged actions behind role-based checks. Church Admin versions through 5.0.9 process requests from any authenticated user, exposing data intended for administrators.

Attack Vector

Exploitation requires an authenticated account on the target WordPress site, such as a subscriber-level user. The attacker issues a request to the vulnerable plugin endpoint over the network. The server returns sensitive information without verifying authorization. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-39553

Indicators of Compromise

• Unexpected HTTP requests from low-privilege user sessions to wp-admin/admin-ajax.php or wp-admin/admin-post.php with Church Admin action parameters
• Access log entries showing subscriber or contributor accounts fetching administrative plugin resources
• Outbound data transfers correlated with authenticated requests to /wp-content/plugins/church-admin/ endpoints

Detection Strategies

• Review WordPress access logs for requests to Church Admin endpoints originating from non-administrative user roles
• Enable WordPress audit logging to capture AJAX and admin-post actions tied to the church-admin plugin
• Monitor for enumeration patterns where a single authenticated session rapidly requests multiple plugin resources

Monitoring Recommendations

• Alert on anomalous API call volumes from low-privilege WordPress accounts
• Track newly created low-privilege accounts followed by access to plugin endpoints
• Correlate web server logs with authentication events to identify unauthorized data access

How to Mitigate CVE-2025-39553

Immediate Actions Required

• Update the Church Admin plugin to a version later than 5.0.9 as soon as the vendor publishes a fixed release
• Audit WordPress user accounts and remove unused or untrusted low-privilege accounts
• Review registration settings and disable open user registration if not required

Patch Information

At the time of publication, the NVD entry references the Patchstack Vulnerability Report for remediation guidance. Administrators should monitor the plugin's update channel for a release above version 5.0.9 and apply it immediately.

Workarounds

• Deactivate the Church Admin plugin until a patched version is available if the risk is unacceptable
• Restrict access to WordPress admin paths with a web application firewall (WAF) rule targeting church-admin actions
• Enforce the principle of least privilege and prevent self-service account creation on affected sites

# Example WAF rule concept to block low-privilege access to plugin endpoints
# Adjust to your WAF syntax (ModSecurity example)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1039553,msg:'Block Church Admin plugin action'"
    SecRule ARGS:action "@rx ^(church_admin|churchadmin_)" "t:lowercase"