{"id":"CVE-2026-125792","kind":"vulnerability","aliases":["CVE-2026-125792"],"related":[],"title":"Church Admin WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8.","summary":"The Church Admin plugin for WordPress, made by Andy Moyle, has a missing authorization check tied to misconfigured access control security levels. Per the NVD entry, it affects versions through 5.1.8; the sources do not state what data or actions an attacker gains.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"church-admin","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["church-admin","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Church Admin plugin version in the WordPress admin under Plugins, or with `wp plugin get church-admin --field=version` if WP-CLI is available.\n- Compare the result against `5.1.8`; versions at or below it are in the stated range.","fix":null,"status":"open","published_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","triaged_at":"2026-11-13T15:49:05+00:00","updated_at":"2026-11-13T15:49:05+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-13T15:49:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Church Admin WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"The Church Admin plugin for WordPress, made by Andy Moyle, has a missing authorization check tied to misconfigured access control security levels. Per the NVD entry, it affects versions through 5.1.8; the sources do not state what data or actions an attacker gains.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","church-admin","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted church administration functions","analyst_note":"Find the vendor advisory or the WordPress plugin changelog for the fixed version and the exact access-control behavior; NVD gives only the range through 5.1.8.","how_to_check":"- Check the installed Church Admin plugin version in the WordPress admin under Plugins, or with `wp plugin get church-admin --field=version` if WP-CLI is available.\n- Compare the result against `5.1.8`; versions at or below it are in the stated range.","plain_action":"","product_name":"church-admin","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Church Admin WordPress plugin at version 5.1.8 or earlier are in the stated range. The sources do not say which configurations or roles are needed to reach the flaw, and they do not name a fixed version.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000742,"input_tokens":4540,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125792':13A,16A '-2026':12A,15A '5.1.8':58B,97C 'access':9A,46B,86C 'action':67B 'admin':2A,19A,22B,30B,78C,81C,93C 'affect':55B,91C 'allow':82C 'andi':36B,75C 'attack':69B 'author':6A,41B,72C 'check':7A,42B 'church':1A,18A,21B,29B,77C,80C,92C 'church-admin':17A,20B,79C 'configur':85C 'control':10A,47B,87C 'cve':11A,14A 'data':65B 'entri':53B 'exploit':83C 'expos':8A 'gain':70B 'host':26B 'incorrect':84C 'issu':90C 'level':49B 'levels.this':89C 'made':34B 'misconfigur':45B 'miss':5A,40B,71C 'moyl':37B,76C 'n/a':95C 'nvd':52B 'packag':23B 'per':50B 'plugin':4A,31B 'secur':48B,88C 'self':25B 'self-host':24B 'sourc':60B 'state':63B 'tie':43B 'version':56B 'vulner':73C 'wordpress':3A,27B,33B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Church Admin WordPress plugin at version 5.1.8 or earlier are in the stated range. The sources do not say which configurations or roles are needed to reach the flaw, and they do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["churchadmin"],"ptokens":["admin","church"],"labels":["churchadmin","medium","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-125792':13A,16A '-2026':12A,15A 'access':9A 'admin':2A,19A 'author':6A 'check':7A 'church':1A,18A 'church-admin':17A 'control':10A 'cve':11A,14A 'expos':8A 'miss':5A 'plugin':4A 'wordpress':3A","search_b":"'5.1.8':58B 'access':46B 'action':67B 'admin':22B,30B 'affect':55B 'andi':36B 'attack':69B 'author':41B 'check':42B 'church':21B,29B 'church-admin':20B 'control':47B 'data':65B 'entri':53B 'gain':70B 'host':26B 'level':49B 'made':34B 'misconfigur':45B 'miss':40B 'moyl':37B 'nvd':52B 'packag':23B 'per':50B 'plugin':31B 'secur':48B 'self':25B 'self-host':24B 'sourc':60B 'state':63B 'tie':43B 'version':56B 'wordpress':27B,33B","search_c":"'5.1.8':97C 'access':86C 'admin':78C,81C,93C 'affect':91C 'allow':82C 'andi':75C 'author':72C 'church':77C,80C,92C 'church-admin':79C 'configur':85C 'control':87C 'exploit':83C 'incorrect':84C 'issu':90C 'levels.this':89C 'miss':71C 'moyl':76C 'n/a':95C 'secur':88C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125792","severity":null,"published_at":"2026-11-13T15:17:40+00:00","modified_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","fetched_at":"2026-11-13T15:46:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}