CVE-2026-0682: SSRF in Church Admin WordPress Plugin

An attacker exploiting this SSRF vulnerability could leverage the Church Admin plugin to query internal services that are not directly accessible from the outside world. This could involve retrieving sensitive configuration data, accessing internal APIs, or even triggering actions on other systems within the network. While the vulnerability requires administrator privileges, a compromised administrator account could grant an attacker significant control over the WordPress environment. The potential blast radius extends to any internal service accessible via HTTP/HTTPS from the WordPress server, posing a risk to data confidentiality and integrity.

1. Reserved2026-01-07
2. Published2026-01-17
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0682 is to immediately upgrade the Church Admin plugin to version 5.0.29 or later. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block outbound requests to suspicious or internal IP addresses. Additionally, restrict the plugin's access to internal network resources by implementing network segmentation. Monitor WordPress logs for unusual outbound HTTP requests originating from the Church Admin plugin. After upgrading, verify the fix by attempting to access an internal resource through the plugin’s audio URL parameter and confirming that the request is blocked or properly sanitized.

Active installs

900Niche

Plugin rating