CVE-2026-58409: ChurchCRM Plugin Upload RCE Vulnerability

CVE-2026-58409 Overview

ChurchCRM is an open-source church management system used by religious organizations to manage members, donations, and events. CVE-2026-58409 is an authenticated Remote Code Execution (RCE) vulnerability affecting ChurchCRM versions prior to 7.4.0. An authenticated administrator can upload a malicious plugin ZIP archive containing a PHP webshell, which the application extracts directly into the web root. The flaw stems from php being explicitly included in the plugin extension allowlist while the denylist fails to block standard .php files. This vulnerability is categorized under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
An authenticated administrator can achieve full Remote Code Execution on the server, resulting in complete compromise of confidentiality, integrity, and availability.

Affected Products

ChurchCRM versions prior to 7.4.0
ChurchCRM plugin installation subsystem (management.php)
ChurchCRM /plugins/install-url API endpoint

Discovery Timeline

2026-07-13 - CVE-2026-58409 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-58409

Vulnerability Analysis

The vulnerability resides in ChurchCRM's plugin installation workflow. The application allows administrators to install plugins by supplying a remote HTTPS URL pointing to a ZIP archive. The /plugins/install-url API route in management.php fetches the archive and validates its integrity against a SHA-256 hash supplied by the requester. Because the requester controls both the ZIP contents and the hash, integrity validation provides no security guarantee.

Once downloaded, the archive is extracted directly under the web root. Any file inside the ZIP with an allowed extension becomes reachable over HTTP. The application does not require the plugin to be enabled through the UI before extracted files are served, meaning webshells execute immediately upon extraction.

Root Cause

The root cause is a misconfigured file extension filter. The ALLOWED_EXTENSIONS list explicitly contains php, and the corresponding DENIED_EXTENSIONS denylist does not block standard .php files. This contradictory policy permits arbitrary PHP source files to be written to a web-served directory. Combined with attacker-controlled hash validation, no meaningful checks prevent malicious archive installation.

Attack Vector

An authenticated administrator sends a POST request to /plugins/install-url referencing an attacker-controlled HTTPS URL and matching SHA-256 hash. The server retrieves the ZIP, verifies the self-supplied hash, and extracts the contents into the plugins directory under the web root. The attacker then requests the dropped PHP webshell over HTTP to execute arbitrary commands with the privileges of the web server process. Because the scope changes to include the underlying host, the impact extends beyond the ChurchCRM application. See the GitHub Security Advisory for full technical details.

Detection Methods for CVE-2026-58409

Indicators of Compromise

Unexpected .php files present under the ChurchCRM plugins/ directory following administrator activity
HTTP POST requests to /plugins/install-url referencing external HTTPS URLs not associated with official ChurchCRM plugin sources
Outbound HTTPS connections from the ChurchCRM host to unfamiliar domains during plugin installation events
Web server access logs showing GET or POST requests to plugin-path PHP files immediately after installation events

Detection Strategies

Monitor filesystem write activity under the ChurchCRM web root, particularly the plugins/ directory, for new .php files
Alert on invocations of the /plugins/install-url endpoint and correlate with subsequent PHP file execution
Inspect web server process trees for child processes such as sh, bash, cmd.exe, or python that indicate webshell activity

Monitoring Recommendations

Enable audit logging for all administrator actions within ChurchCRM, especially plugin management operations
Ingest web server access logs and PHP-FPM logs into a centralized SIEM for correlation and retention
Baseline outbound network traffic from the application host to detect anomalous HTTPS fetches during plugin installs

How to Mitigate CVE-2026-58409

Immediate Actions Required

Upgrade ChurchCRM to version 7.4.0 or later without delay
Audit the plugins/ directory for unauthorized .php files and remove any suspicious content
Rotate all ChurchCRM administrator credentials and review administrator account membership
Review web server and application logs for prior invocations of /plugins/install-url from unexpected sources

Patch Information

The vulnerability is fixed in ChurchCRM version 7.4.0. Administrators should upgrade immediately following the vendor's release notes. Refer to the ChurchCRM Security Advisory GHSA-37mf-vq43-5qp9 for authoritative remediation guidance.

Workarounds

Restrict network access to the ChurchCRM administrative interface using firewall rules or a VPN
Enforce strong, unique passwords and multi-factor authentication for all administrator accounts to reduce the risk of account compromise
Configure the web server to deny execution of PHP files under the plugins/ directory until the patch is applied
Block outbound HTTPS traffic from the ChurchCRM host to untrusted destinations at the network egress point

bash

# Example Apache configuration to deny PHP execution in plugins directory
<Directory "/var/www/churchcrm/plugins">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>