CVE-2026-0682

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0682", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-07T18:03:26.237Z", "datePublished": "2026-01-17T03:24:24.110Z", "dateUpdated": "2026-04-08T17:01:39.665Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:39.665Z"}, "affected": [{"vendor": "andy_moyle", "product": "Church Admin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.0.28", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audio_url' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77227fc5-7c38-476d-af4c-4b2ad3dd8420?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/sermon-podcast.php#L1181"}, {"url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/sermon-podcast.php#L1181"}, {"url": "https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/functions.php#L6297"}, {"url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/functions.php#L6297"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440847%40church-admin&new=3440847%40church-admin&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "baseScore": 2.2, "baseSeverity": "LOW"}}], "credits": [{"lang": "en", "type": "finder", "value": "Phap Nguyen Anh"}], "timeline": [{"time": "2026-01-08T22:21:35.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-16T14:51:20.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T18:47:43.198878Z", "id": "CVE-2026-0682", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T19:23:48.794Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0682", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T18:47:43.198878Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T18:54:15.504Z"}}], "cna": {"title": "Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Phap Nguyen Anh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.2, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "andy_moyle", "product": "Church Admin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.0.28"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-08T22:21:35.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-16T14:51:20.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77227fc5-7c38-476d-af4c-4b2ad3dd8420?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/sermon-podcast.php#L1181"}, {"url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/sermon-podcast.php#L1181"}, {"url": "https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/functions.php#L6297"}, {"url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/functions.php#L6297"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440847%40church-admin&new=3440847%40church-admin&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audio_url' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-17T03:24:24.110Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0682", "state": "PUBLISHED", "dateUpdated": "2026-01-20T19:23:48.794Z", "dateReserved": "2026-01-07T18:03:26.237Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-17T03:24:24.110Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Church Admin", "vendor": "andy_moyle", "versions": [{"lessThanOrEqual": "5.0.28", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audio_url' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin Church Admin para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 5.0.28, inclusive, debido a la validaci\u00f3n insuficiente de las URL proporcionadas por el usuario en el par\u00e1metro 'audio_url'. Esto permite a atacantes autenticados, con acceso de nivel de Administrador, realizar peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede usarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2026-0682", "lastModified": "2026-06-17T10:11:12.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0682", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T18:47:43.198878Z", "version": "2.0.3"}}]}, "published": "2026-01-17T04:16:07.987", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/functions.php#L6297"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/sermon-podcast.php#L1181"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/functions.php#L6297"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/sermon-podcast.php#L1181"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440847%40church-admin&new=3440847%40church-admin&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77227fc5-7c38-476d-af4c-4b2ad3dd8420?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T07:55:33.496853+00:00", "value": {"mitigation_remediation": ["Update the Church Admin plugin to a release newer than 5.0.28.", "Revise or remove Administrator privileges from accounts that do not need full access for routine tasks.", "Apply server\u2011side filtering or firewall rules to restrict outbound HTTP requests from the WordPress site, limiting the audio_url parameter to a whitelist of trusted domains."], "summary": {"action": "Patch Now", "impact": "Blind Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "Versions of the Church Admin plugin through and including 5.0.28, released by andy_moyle, are affected. Any WordPress installation running one of these releases is at risk if it contains accounts with Administrator privileges.", "description_and_impact": "The Church Admin plugin for WordPress contains an in\u2011proper validation flaw in the audio_url parameter that allows a user with Administrator rights to supply any URL. When the plugin processes this input, it issues an HTTP request from the server to the specified address, enabling the attacker to reach internal services or perform write operations against them. This reaches beyond simple data exfiltration and can affect application state or confidential internal resources, but does not result in code execution or privilege escalation outside the web application.", "risk_and_exploitability": "The flaw is scored as a low\u2011severity vulnerability with a very low likelihood of exploitation in practice, and it is not currently listed in the CISA known exploited vulnerabilities catalog. Exploitation requires an authenticated Administrator user, so the threat is confined to sites with such privileged accounts. When used, the attacker can only issue requests from the server to internal resources, which limits the damage compared to higher\u2011level attacks such as remote code execution."}}}}, "created": "2026-01-19T09:19:29.194916+00:00", "updated": "2026-04-16T08:00:11.196944+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}