CVE-2026-39340

ChurchCRM versions prior to 7.1.0 contain a SQL injection vulnerability in PropertyTypeEditor.php that affects the property type management functionality. The flaw stems from replacing secure input validation with insufficient sanitization, allowing authenticated users with MenuOptions role (a non-admin staff position) to execute arbitrary SQL queries and extract sensitive database information including user password hashes. The vulnerability has a CVSS score of 8.1 (HIGH) with network accessibility, low attack complexity, and requires low privileges. While not requiring user interaction, the impact is significant, enabling unauthorized data exfiltration and potential privilege escalation through compromised credentials. The attack leverages time-based blind SQL injection techniques to systematically extract confidential information. Active exploitation of this vulnerability is not currently documented, and it does not appear on the Known Exploited Vulnerabilities list. However, the FAUCET risk score of 50.0 indicates moderate concern, and the relatively high EPSS score suggests the vulnerability warrants prompt patching. Organizations running ChurchCRM should upgrade to version 7.1.0 immediately to remediate this risk, particularly if MenuOptions role accounts are widely distributed among staff members.