WordPress WPCHURCH plugin <= 2.7.0 - SQL Injection Vulnerability

The SQL Injection vulnerability in WPCHURCH allows an attacker to craft malicious SQL queries that are executed against the database. Successful exploitation could lead to the extraction of sensitive information such as user credentials, financial data, and other confidential details stored within the WPCHURCH database. Furthermore, an attacker could potentially modify or delete data, leading to data integrity issues and disruption of service. The 'Blind SQL Injection' nature of the vulnerability means the attacker doesn't directly see the results of their queries, requiring more sophisticated techniques to extract data, but doesn't diminish the potential impact. This is similar to other SQL injection vulnerabilities where attackers use techniques like time-based injection to infer data.

Websites utilizing WPCHURCH, particularly those running older, unpatched versions (n/a - 2.7.0), are at significant risk. Shared hosting environments where multiple websites share the same database are particularly vulnerable, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r "SELECT .* FROM" /var/www/html/wp-content/plugins/wpchurch/

• generic web:

curl -I https://your-wpchurch-site.com/index.php?page=some_parameter&value=$(sql_injection_payload)

• database (mysql):

SELECT @@version FROM information_schema.version;

• wordpress / composer / npm:

wp plugin list --status=all | grep wpchurch

• wordpress / composer / npm:

find /var/www/html/wp-content/plugins/wpchurch/ -type f -name '*.php' -print0 | xargs -0 grep -i 'mysql_query'

1. 2026-01-07Disclosure

   disclosure

1. Réservé2025-04-04
2. Publiée2026-01-07
3. Modifiée2026-04-28
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-32303 is to immediately upgrade WPCHURCH to version 2.7.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. While a direct WAF rule is difficult to create for blind SQL injection, input validation and parameterized queries on the application layer can help reduce the attack surface. Review and restrict database user permissions to limit the potential damage from a successful injection. Monitor database logs for suspicious SQL queries that may indicate an ongoing attack.