CVE-2026-40581

OVERVIEW ChurchCRM versions prior to 7.2.0 contain a critical CSRF vulnerability in the SelectDelete.php endpoint that allows unauthorized deletion of family records and associated data. The vulnerability affects the open-source church management system and permits attackers to permanently remove sensitive organizational information including family records, notes, pledges, person data, and property records through a single malicious web request. SEVERITY The vulnerability carries a CVSS 3.1 score of 8.1 (HIGH) with a network-based attack vector requiring only low complexity and no special privileges, though user interaction is required. The attack is irreversible and impacts system integrity and availability, as successful exploitation results in permanent loss of critical organizational data with no recovery mechanism. The high impact rating reflects the destructive nature of complete data deletion without authentication controls or warning prompts. EXPLOITATION STATUS Current exploitation activity is minimal, with no confirmation of active in-the-wild exploitation. The vulnerability has not been designated as a Known Exploited Vulnerability (KEV) by CISA, and the EPSS probability score of 0.00005 indicates extremely low likelihood of near-term exploitation compared to other disclosed vulnerabilities. Organizations using ChurchCRM should prioritize upgrading to version 7.2.0 to implement CSRF token validation, but this does not represent an imminent threat environment.