CVE-2026-58409 is a critical vulnerability in ChurchCRM CRM prior to version 7.4.0. The vulnerability arises because the application explicitly includes 'php' in its allowed plugin archive extensions, while the denylist fails to block standard .php files. When an authenticated administrator uses the /plugins/install-url API to install a plugin from a malicious ZIP archive containing PHP files, these files are extracted directly under the web root and become immediately executable via HTTP. This allows remote code execution without needing to enable the plugin through the UI. The vulnerability has been addressed in ChurchCRM version 7.4.0.

Successful exploitation allows an authenticated administrator to execute arbitrary PHP code on the server, resulting in full remote code execution. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability requires administrator privileges but does not require user interaction beyond the authenticated API call. The CVSS v3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Upgrade ChurchCRM to version 7.4.0 or later, where this vulnerability has been fixed. The fix removes 'php' from the allowed plugin archive extensions and corrects the denylist to block dangerous file types. Until upgrading, restrict administrator access to trusted personnel only and avoid using the /plugins/install-url API with untrusted sources. Patch status is not explicitly stated in vendor advisories but the fix is confirmed in version 7.4.0.