Security Alert Summary
The Church Admin plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in the handling of the audio_url parameter. Authenticated users with Administrator-level privileges can cause the application to make HTTP requests to arbitrary locations, which may allow querying or modification of internal services.
CVE Details
- CVE ID: CVE-2026-0682
- Affected component: The Church Admin plugin for WordPress
- Affected versions: All versions up to, and including, 5.0.28
- Published: January 17, 2026 at 4:16:07 AM (time zone not specified)
- Last modified: January 17, 2026 at 4:16:07 AM (time zone not specified)
- CVSS v3.1: Base Score 2.2 (LOW) — Vector:
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / User Interaction: Authentication required — privileges required: High (administrator-level). User interaction: None.
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE: CWE-918 (Server-Side Request Forgery)
Technical Details
This issue is a Server-Side Request Forgery (SSRF) stemming from insufficient validation of user-supplied URLs provided via the audio_url parameter. When the plugin accepts and uses that parameter without adequate validation or whitelisting, an authenticated administrator can cause the application to initiate web requests to attacker-controlled or internal addresses.
The CVE references indicate related code locations in the plugin’s codebase (for example, includes/functions.php and includes/sermon-podcast.php in the project tree). The core weakness is the lack of proper validation or access control on the URL input, allowing requests originating from the web application to arbitrary locations and enabling queries or modifications of internal services if those services accept such requests.
How This Could Impact Your Website
Consider a small organization running Church Admin with multiple WordPress accounts: a site owner (administrator), several staff editors, and an external contractor who is granted administrator access for content updates. If an administrator account is used maliciously or is compromised, the attacker could use the vulnerability to make requests from the server to internal endpoints (for example, metadata, internal APIs, or management interfaces) that are not directly accessible from the public internet. That could expose information held by internal services or, depending on those services, allow limited modifications that align with the CVSS integrity impact.
Practical consequences include increased ability for an attacker to enumerate internal endpoints, gather configuration or user-related information (such as internal email addresses), and raise the risk of targeted phishing or social engineering against staff. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Apply the vendor’s update as soon as a patched version is released. (Fixed version is not specified in the CVE entry.)
- Review and reduce unnecessary administrator-level accounts; avoid granting administrator privileges to external contractors unless absolutely required.
- Review and reduce unnecessary user roles, especially contributor and editor accounts with elevated privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site and server activity for unusual outbound requests or unexpected interactions with internal services.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/functions.php#L6297
- https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/sermon-podcast.php#L1181
- https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/functions.php#L6297
- https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/sermon-podcast.php#L1181
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440847%40church-admin&new=3440847%40church-admin&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/77227fc5-7c38-476d-af4c-4b2ad3dd8420?source=cve
