Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist (DENIED_EXTENSIONS) fails to block standard .php files. Because `php` is explicitly included in the allowed extension list for plugin archives, and extracted files are placed directly under the web root, any PHP file inside the ZIP becomes immediately executable via HTTP — without even needing to "enable" the plugin through the application UI. The /plugins/install-url API route (management.php) allows an administrator to source the malicious ZIP from any attacker-controlled HTTPS URL, validating it only against an attacker-supplied SHA-256 hash. This issue has been fixed in version 7.4.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-58409: ευπάθεια RCE στο ChurchCRM μέσω κακόβουλου plugin https://secn.ws/DklmiK
Post summary
The tweet announces CVE‑2026‑58409 as an RCE vulnerability in ChurchCRM triggered by a malicious plugin. No PoC, exploit, or mitigation details are provided, and there is no evidence of active exploitation.
🚨*CVE* CVE-2026-58409 ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by … https://www.cve.org/CVERecord?id=CVE-2026-58409 ----- Traducción: CVE-2026-58409 Chu… http://infoflow.cloud`
Post summary
The post announces CVE-2026-58409 for ChurchCRM, noting an authenticated administrator can trigger RCE in versions before 7.4.0, and provides a link to the CVE record, but no exploit code or patch details are included.
CVE-2026-58409 ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by … https://www.cve.org/CVERecord?id=CVE-2026-58409
Post summary
The CVE-2026-58409 vulnerability allows authenticated administrators to execute remote code on ChurchCRM servers prior to version 7.4.0, and a patch is implied in later releases.