CVE-2024-37418: 
WordPress vulnerability analysis and mitigation

The Church Admin WordPress plugin contains an arbitrary file upload vulnerability (CVE-2024-37418) that affects versions up to and including 4.4.6. The vulnerability was discovered by Peng Zhou and publicly disclosed on July 4, 2024. This security issue allows authenticated users with subscriber-level access or higher to upload arbitrary files to the web server (WPScan, Patchstack).

The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type (CWE-434) with a CVSS v3.1 score of 9.9 (Critical), indicating its severe nature. The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which suggests that it can be exploited over the network with low attack complexity, requires low privileges, and can result in high impacts to confidentiality, integrity, and availability (Patchstack).

The vulnerability could allow attackers to upload arbitrary files, including malicious web shells, to the affected website's server. This capability could potentially lead to remote code execution, giving attackers significant control over the compromised system (WPScan, Patchstack).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. According to Patchstack, this vulnerability is known to be exploited in the wild and is considered highly dangerous with expectations of mass exploitation (Patchstack).

The vulnerability has been fixed in version 4.4.7 of the Church Admin plugin. Website administrators are strongly advised to update to this version or later immediately. For users of Patchstack, virtual patching is available to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).