CVE-2026-39342 is a critical SQL injection vulnerability (CWE-89) in ChurchCRM's CRM product affecting versions prior to 7.1.0. The flaw exists in the handling of the 'searchwhat' parameter in QueryView.php when QueryID=15 is used. An authenticated user with access to the Data/Reports > Query Menu and the Advanced Search query can exploit this vulnerability to inject malicious SQL commands. The vulnerability has a CVSS 4.0 score of 9.4, indicating high exploitability and impact. The issue is resolved in ChurchCRM version 7.1.0. No cloud service is involved, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an authenticated user with limited privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. Given the high CVSS score and the nature of SQL injection, the impact is critical, affecting confidentiality, integrity, and availability of the affected system's data.

Upgrade ChurchCRM to version 7.1.0 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version and apply the update accordingly. Restrict access to the Data/Reports > Query Menu and Advanced Search query to trusted users only until the update is applied. Patch status is not explicitly confirmed beyond the version fix; check the vendor's official channels for the latest remediation guidance.