This vulnerability, identified as CVE-2026-66478 and classified under CWE-89, involves improper neutralization of special elements used in SQL commands in the Church Admin software by andy_moyle. It affects all versions up to 5.1.1, allowing unauthenticated attackers to perform SQL Injection attacks remotely. The CVSS 3.1 base score is 9.3, reflecting a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact. There is no vendor advisory or patch available at this time.

Successful exploitation can lead to unauthorized disclosure of sensitive data due to high confidentiality impact. The vulnerability does not affect integrity but may cause a low level of availability disruption. Since no authentication is required, the attack surface is broad, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing web application firewalls or other SQL injection detection and prevention controls as temporary measures.