Security readout for executives and security teams
Plain-English summary
This is a SQL injection flaw in the Mojoomla WPCHURCH Church Management System WordPress plugin. A vulnerable site could expose database data if an attacker reaches the affected id parameter. The source bundle does not identify affected versions, a CVSS score, or a vendor patch.
Executive priority
Treat this as a priority if the plugin is internet-facing or handles member, donor, or church operations data. Urgency drops if the plugin is not installed or the affected route is not reachable.
Technical view
CVE-2017-14845 describes SQL injection through the id parameter in Mojoomla WPCHURCH Church Management System for WordPress. The only named technical evidence is the CVE description and a public Exploit-DB reference. Version range, authentication requirements, and remediation status are not provided.
Likely exposure
Exposure is likely limited to WordPress sites running the Mojoomla WPCHURCH Church Management System plugin. The source bundle does not provide vulnerable versions or CPEs, so inventory confirmation is required.
Exploitation context
A public Exploit-DB reference exists, indicating exploit information was published. The CVE is not marked as KEV in the provided bundle, and no cited source confirms active exploitation.
Researcher notes
Evidence is sparse: no CVSS, CWE, affected versions, patch reference, or authentication context are provided. Do not assume exploitability details beyond SQL injection via id and the existence of a public Exploit-DB reference.
Mitigation direction
- Inventory WordPress sites for the WPCHURCH Church Management System plugin.
- Check vendor or WordPress plugin guidance for patched versions or retirement status.
- Disable or remove the plugin where it is not business-critical.
- Restrict administrative and plugin-facing access where feasible.
- Review database backups and incident response readiness for affected sites.
Validation and detection
- Confirm whether WPCHURCH Church Management System is installed on production WordPress sites.
- Record installed plugin versions and compare them with vendor guidance.
- Review web and application logs for suspicious id parameter activity.
- Check database logs for unexpected errors or abnormal query patterns.
- Verify compensating controls are documented for any still-exposed installation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-14845 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 42800CVE reference · exploit, x_refsource_EXPLOIT-DB
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.