Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-40581 ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversi… https://www.cve.org/CVERecord?id=CVE-2026-40581
Post summary
The post announces CVE-2026-40581, detailing that versions of ChurchCRM before 7.2.0 expose a permanent deletion flaw in the SelectDelete.php endpoint.
⚠️ HIGH — CVE-2026-40581 ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (… CVSS 8.1 Full analysis → https://sec.kaitan.id/cves/CVE-2026-40581 #HP #CyberSecurity #InfoSec
Post summary
CVE-2026-40581 is a high‑severity flaw (CVSS 8.1) affecting ChurchCRM prior to version 7.2.0, with detailed analysis available but no PoC, exploit, or patch information disclosed.