CVE-2025-31643

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

Incorrect Privilege Assignment vulnerability in Dasinfomedia WPCHURCH allows Privilege Escalation.This issue affects WPCHURCH: from n/a through 2.7.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

Vendor	Product	Versions
Dasinfomedia	WPCHURCH	<= 2.7.0

References

https://patchstack.com/database/wordpress/plugin/church-management/vulnerability/wordpress-wpchurch-2-7-0-privilege-escalation-vulnerability?_s_id=cve

Timeline

Published: Jan 7, 2026
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-316448.7When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) comman CVE-2025-316456.7Uncontrolled search path for some System Event Log Viewer Utility software for all versions within Ring 3: User Applications may allow an es CVE-2025-316476.7Uncontrolled search path for some Intel(R) Graphics Software before version 25.22.1502.2 within Ring 3: User Applications may allow an escal CVE-2025-316483.9Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. Startup code and CVE-2025-316498.7A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell CVE-2025-31655.3A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chit CVE-2025-316507.5Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomp CVE-2025-316519.8Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configur CVE-2025-316545.3An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").CVE-2025-316556.7Incorrect default permissions for some Intel(R) Battery Life Diagnostic Tool within Ring 3: User Applications may allow an escalation of pri CVE-2025-31667.8A vulnerability classified as critical was found in code-projects Product Management System 1.0. This vulnerability affects the function sea CVE-2025-31677.5A vulnerability, which was classified as problematic, has been found in Tenda AC23 16.03.07.52. This issue affects some unknown processing o