Read the docs
TI-2022-00740 Aliases CVE-2022-0833GHSA-9vf6-r8jp-w3m7

Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure

Priority LOW 21CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-862.

Summary

The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to disclose the final backup filename, which can then be fetched by the attacker to download the backup of the plugin's DB data

Why it matters now

EPSS 0.00494 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Church Admin (Unknown): 3.4.135

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownChurch Adminbefore 3.4.1353.4.135Patch availableCNA
  • Church Admin VendorUnknown Affected before 3.4.135 Fixed in 3.4.135 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:church_admin_project:church_admin:*:*:*:*:*:wordpress:*:*before 3.4.135Vulnerableandy_moyle
  • cpe:2.3:a:church_admin_project:church_admin:*:*:*:*:*:wordpress:*:* Versions before 3.4.135 Vulnerable ·andy_moyle

Remediation

  • Fix · CNA Church Admin (Unknown) Fixed in 3.4.135

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0833
  2. 2026-10-03 Alias added: GHSA-9vf6-r8jp-w3m7

References

Exploit 1

  • TI-2024-20656 WordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2024-24922 WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2024-19990 WordPress Church Admin plugin <= 4.0.27 - SQL Injection via shortcode vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-16887 WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
  • TI-2015-03461 Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for… CVSS 2.0MEDIUM 4.3
  • TI-2024-23633 WordPress Church Admin plugin <= 4.4.4 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences