CVE-2024-30493 in Church Admin Plugin
Summary
by MITRE • 03/29/2024
Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/01/2026
The cross-site request forgery vulnerability identified as CVE-2024-30493 represents a critical security flaw in the Church Admin plugin for WordPress systems. This vulnerability specifically impacts versions ranging from the initial release through version 4.1.7, creating a significant risk for churches and religious organizations that rely on this administrative tool for managing their digital presence. The issue stems from inadequate validation of cross-site requests, allowing malicious actors to exploit the plugin's functionality through crafted web requests that appear to originate from authenticated users.
The technical flaw manifests in the plugin's failure to implement proper CSRF protection mechanisms within its administrative interfaces. When users access the Church Admin plugin's management functions, the system does not adequately verify that requests are genuinely initiated by the authenticated user rather than by an attacker who has lured the user into executing malicious actions. This vulnerability falls under CWE-352, which specifically addresses Cross-Site Request Forgery weaknesses in software applications. The absence of anti-CSRF tokens or other validation mechanisms means that attackers can potentially perform unauthorized administrative actions such as modifying church member data, altering service schedules, or manipulating financial records without proper authorization.
The operational impact of this vulnerability extends beyond simple data integrity concerns to encompass potential disruption of church operations and compromise of sensitive information. An attacker exploiting this vulnerability could gain unauthorized access to church administrative functions, potentially leading to data breaches, service disruptions, or even financial fraud through manipulation of donation records and membership information. Organizations using the affected plugin versions face significant risk of unauthorized modifications to their church management systems, which could affect their ability to maintain accurate records and provide proper services to their congregations.
Mitigation strategies for this vulnerability should prioritize immediate remediation through updating to the latest version of the Church Admin plugin where the CSRF protection has been properly implemented. Organizations should also implement additional security measures such as monitoring for unauthorized administrative activities, ensuring proper network segmentation, and conducting regular security assessments of their WordPress installations. The ATT&CK framework categorizes this vulnerability under the T1566 technique for Initial Access through phishing attacks, as attackers may leverage CSRF exploits to gain unauthorized access to administrative accounts. Security teams should also consider implementing web application firewalls and monitoring for suspicious patterns in administrative requests that could indicate exploitation attempts. Regular patch management procedures should be enforced to ensure all WordPress plugins and themes remain up-to-date with the latest security patches and vulnerability fixes.