CVE-2026-40484 — AI Deep Analysis Summary

🚨 **Essence**: ChurchCRM < 7.2.0 has a critical flaw in its **Database Backup/Restore** feature. 📉 **Consequences**: Attackers can achieve **Remote Code Execution (RCE)** and **Cross-Site Request Forgery (CSRF)**.…

🛡️ **Root Cause**: Two major failures identified: 1️⃣ **Missing File Extension Filtering** (allows uploading malicious files). 2️⃣ **Missing CSRF Token Validation** (allows unauthorized state changes).…

🏢 **Affected Vendor**: ChurchCRM. 📦 **Product**: CRM System. 📅 **Versions**: All versions **prior to 7.2.0**. If you are running 7.1.x or older, you are vulnerable! ⚠️

💀 **Attacker Capabilities**: 1️⃣ **RCE**: Execute arbitrary code on the server. 2️⃣ **CSRF**: Trick admins into performing actions.…

🔐 **Exploitation Threshold**: **Medium-High**. The CVSS vector indicates **PR:H** (Privileges Required: High). You likely need valid admin credentials to access the backup/restore function.…

🕵️ **Public Exploit**: **No**. The `pocs` array is empty. No public Proof-of-Concept (PoC) or wild exploitation code is available yet.…

🔍 **Self-Check**: 1️⃣ Check your ChurchCRM version (is it < 7.2.0?). 2️⃣ Review access logs for unusual database backup/restore requests. 3️⃣ Scan for the specific backup endpoints if you have admin access.…

✅ **Official Fix**: **Yes**. Patched in **Version 7.2.0**. 📝 **References**: See GitHub Commit `68be1d1` and PR `#8610`. The vendor has acknowledged the issue (GHSA-2932-77f9-62fx) and released a fix. Update immediately!…

🚧 **No Patch Workaround**: 1️⃣ **Restrict Access**: Block access to the backup/restore module via firewall/WAF if possible. 2️⃣ **Disable Feature**: If the UI allows, disable the database backup function entirely.…

🔥 **Urgency**: **HIGH**. CVSS Score is **9.8** (Critical). Even though privileges are required, the impact (RCE) is devastating. 🚀 **Action**: Upgrade to v7.2.0+ **NOW**. Do not delay! Time is of the essence. ⏳