CVE-2021-3164

8.8 HIGH

ChurchRota 2.6.4 is vulnerable to authenticated remote code execution

Published: 2021-01-26 · Last updated: 2026-06-17

Severity and scoring

CVSS: 8.8 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-434

Affected products

Vendor	Product
churchdesk	churchrota

Description

ChurchRota 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to have file upload permission in order to upload and execute an arbitrary file via a POST request to resources.php.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3164
[Other]https://github.com/Little-Ben/ChurchRota
[Exploit reference]https://github.com/rmccarth/cve-2021-3164
[Other]https://github.com/Little-Ben/ChurchRota
[Exploit reference]https://github.com/rmccarth/cve-2021-3164

Related CVEs

Same CWE

CVE-2026-40750 — Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server (9.9 CRITICAL)
CVE-2026-6933 — The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and inclu... (8.8 HIGH)
CVE-2026-40772 — Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions (10.0 CRITICAL)
CVE-2026-39591 — Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions (9.9 CRITICAL)
CVE-2026-39527 — Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions (5.4 MEDIUM)