The vulnerability in ChurchCRM CRM versions before 7.2.0 is a CSRF issue (CWE-352) affecting the SelectDelete.php endpoint responsible for deleting family records. Because the deletion action is triggered by a GET request without CSRF protection, an attacker can cause an authenticated admin to unknowingly delete critical data including family records, notes, pledges, persons, and property data. This results in irreversible data loss. The issue is resolved in version 7.2.0.

Exploitation leads to permanent and irreversible deletion of family records and all associated data, causing high impact on data integrity and availability. There is no confidentiality impact reported. The attack requires the victim to be an authenticated administrator who visits a malicious page.

Upgrade ChurchCRM to version 7.2.0 or later, where this vulnerability has been fixed by adding proper CSRF token validation to the deletion endpoint. Until upgraded, restrict access to the deletion functionality to trusted users and avoid visiting untrusted links while authenticated as an administrator. Patch status is not explicitly stated but the vendor fixed the issue in version 7.2.0.