CVE-2025-57896: Church Admin Authorization Bypass Flaw

CVE-2025-57896 Overview

CVE-2025-57896 is a missing authorization vulnerability in the andy_moyle Church Admin WordPress plugin. The flaw affects all versions of church-admin up to and including 5.0.26. Attackers can exploit incorrectly configured access control security levels to interact with plugin functionality that should require higher privileges. The issue is tracked under CWE-862: Missing Authorization and was published to the National Vulnerability Database (NVD) on August 22, 2025.

Critical Impact
Unauthenticated attackers can reach plugin endpoints over the network without user interaction, resulting in limited integrity impact on affected WordPress sites.

Affected Products

andy_moyle Church Admin (church-admin) plugin for WordPress
All versions from n/a through 5.0.26
WordPress sites with the Church Admin plugin installed and activated

Discovery Timeline

2025-08-22 - CVE-2025-57896 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57896

Vulnerability Analysis

The vulnerability stems from broken access control within the Church Admin WordPress plugin. The plugin exposes functionality without enforcing proper capability or role verification. Attackers reach the affected endpoints over the network with no authentication and no user interaction. Successful exploitation allows limited unauthorized modification of plugin data or state.

Missing authorization defects like this occur when developers rely on obscurity, nonces, or client-side controls rather than server-side capability checks. In WordPress plugins, this typically means an AJAX action, REST route, or admin-post handler skips calls to current_user_can() or a comparable check. The result is that any visitor, including unauthenticated users, can invoke privileged actions.

Root Cause

The root cause is incorrectly configured access control security levels within church-admin code paths. Server-side authorization checks are absent or misconfigured on one or more request handlers. This maps directly to CWE-862 (Missing Authorization), where the software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends crafted HTTP requests to the vulnerable plugin endpoints. No credentials, tokens, or user interaction are required. The Exploit Prediction Scoring System (EPSS) score is 0.209% at the 11.105 percentile, indicating low observed exploitation likelihood at this time.

No verified public proof-of-concept code is available. For technical specifics, refer to the Patchstack advisory for the Church Admin plugin.

Detection Methods for CVE-2025-57896

Indicators of Compromise

Unauthenticated POST or GET requests to wp-admin/admin-ajax.php referencing Church Admin actions
Unexpected requests to plugin REST routes under /wp-json/ associated with church-admin
Unexplained modifications to plugin-managed records or WordPress options
Access log entries showing requests to church-admin endpoints from unauthenticated sources

Detection Strategies

Review WordPress access logs for requests targeting church-admin handlers without a valid authenticated session cookie
Enable WordPress audit logging plugins to record privileged actions and correlate them with source IPs
Alert on anomalous spikes in AJAX or REST calls referencing the plugin
Track version inventory of installed WordPress plugins to confirm any host running church-admin<= 5.0.26

Monitoring Recommendations

Forward web server and WordPress logs to a centralized SIEM or data lake for correlation
Baseline expected traffic to plugin endpoints and alert on deviations from normal patterns
Monitor changes to database tables and options associated with the Church Admin plugin
Track outbound connections from the WordPress host that follow suspicious plugin requests

How to Mitigate CVE-2025-57896

Immediate Actions Required

Update the Church Admin plugin to a version above 5.0.26 once released by the maintainer
Inventory all WordPress instances and confirm which sites have church-admin installed and activated
If no fixed version is available, deactivate and remove the plugin until a patch is published
Review WordPress user roles and audit for unauthorized changes to plugin data

Patch Information

As of the latest NVD update on 2026-06-17, the Patchstack advisory identifies all versions through 5.0.26 as affected. Administrators should monitor the plugin's WordPress.org page and the Patchstack database for a fixed release, then apply the update promptly.

Workarounds

Deactivate the Church Admin plugin until an official patch is available
Restrict access to wp-admin/admin-ajax.php and /wp-json/ plugin routes via a web application firewall (WAF)
Add virtual patching rules through a WAF or Patchstack integration to block requests to vulnerable endpoints
Limit HTTP access to the WordPress admin surface using IP allowlisting where feasible

bash

# Example nginx rule to block unauthenticated access to Church Admin REST routes
location ~* /wp-json/church-admin/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}