Low severity · published Jan 17, 2026
CVE-2026-0682
Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
2.2
CVSS
0.3%
EPSS
No
On KEV
Description
The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audio_url' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Church Admin · andy_moyle
through 5.0.28 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0682
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0682
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/functions.php#L6297
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/sermon-podcast.php#L1181
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/functions.php#L6297
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/sermon-podcast.php#L1181
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440847%40church-admin&new=3440847%40church-admin&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/77227fc5-7c38-476d-af4c-4b2ad3dd8420?source=cve
More from Church Admin
9.9
CVE-2024-37418
WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability
9.3
CVE-2026-66478
WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability
9.3
CVE-2025-26941
WordPress Church Admin plugin <= 5.0.18 - SQL Injection vulnerability
8.8
CVE-2024-31280
WordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerability
8.8
CVE-2024-30244
WordPress Church Admin plugin <= 4.0.27 - SQL Injection via shortcode vulnerability