Security readout for executives and security teams
Plain-English summary
This affects WordPress sites using Church Admin through 5.0.28. A logged-in administrator could make the site’s server request arbitrary URLs through the audio_url parameter. Business urgency is low because administrator access is required, but risk rises if admin accounts are compromised or the web server can reach sensitive internal services.
Executive priority
Treat as routine patch management unless the affected site has many administrators, weak admin account controls, or network access to sensitive internal systems. Prioritize confirmation and upgrade during the next maintenance window, with faster action for externally hosted sites connected to internal networks.
Technical view
CVE-2026-0682 is a blind SSRF in the Church Admin WordPress plugin, attributed to insufficient validation of user-supplied URLs in audio_url. Sources list affected versions up to and including 5.0.28. CVSS is 2.2 with high privileges and high complexity required, and potential integrity impact against reachable internal services.
Likely exposure
Likely exposure is limited to WordPress installations running Church Admin up to and including 5.0.28. Exploitation requires an authenticated Administrator-level account. Practical risk is higher where the WordPress host can reach internal services, private APIs, or administrative endpoints not otherwise exposed externally.
Exploitation context
The source bundle does not indicate known active exploitation, and this CVE is not marked KEV. The issue is blind SSRF, meaning the attacker may not directly see responses. It is most relevant as a post-compromise or malicious-admin scenario rather than a typical unauthenticated internet-scale threat.
Researcher notes
Evidence is sufficient for scope and impact but incomplete on exact fixed version in the provided bundle. The WordPress Trac references and changeset should be reviewed to confirm the code change. Avoid assuming unauthenticated exploitability; the documented requirement is Administrator-level access.
Mitigation direction
- Inventory WordPress sites for the Church Admin plugin and version.
- Upgrade Church Admin beyond 5.0.28 when vendor guidance confirms the fixed release.
- Review the WordPress plugin changelog and referenced changeset for remediation confirmation.
- Restrict WordPress Administrator accounts to trusted users only.
- Limit outbound network access from WordPress servers to internal services where feasible.
- Monitor administrator activity involving sermon podcast or audio URL features.
Validation and detection
- Confirm whether Church Admin is installed on each WordPress site.
- Verify installed versions are not 5.0.28 or earlier.
- Review admin audit logs for unexpected audio_url or sermon podcast changes.
- Check server egress logs for unusual requests to internal addresses.
- Validate remediation against the vendor changelog or WordPress Trac changeset.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-0682 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N0.71.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
2.2LowVector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/77227fc5-7c38-476d-af4c-4b2ad3dd8420?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/sermon-podcast.php#L1181CVE reference
- https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/sermon-podcast.php#L1181CVE reference
- https://plugins.trac.wordpress.org/browser/church-admin/trunk/includes/functions.php#L6297CVE reference
- https://plugins.trac.wordpress.org/browser/church-admin/tags/5.0.27/includes/functions.php#L6297CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440847%40church-admin&new=3440847%40church-admin&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.