The CVSS 9.3 on CVE-2026-66478 is technically accurate — an unauthenticated SQL injection in Church Admin handling donations, pastoral notes, family records, and health information is unambiguously critical. But the EPSS score of 0.00291 tells you something the severity rating doesn't: automated exploitation hasn't arrived yet. That gap between headline criticality and actual exploitation reality is where your resource allocation decision lives.
The 2026 date in the CVE ID is anomalous and matters more than it should. Either this is a coordinated disclosure scheduled for the future (meaning you've been unknowingly vulnerable for months or years while the vendor coordinated), or it's a publication artifact that masks a recent disclosure. If you're on an older version of Church Admin, assume you've been exposed — the question isn't whether the window opened yesterday, it's how long it's been wide open.
For defenders with patching authority: prioritize this in your next cycle, not as an emergency, but as a tracked item with a known exploitation window approaching. The EPSS will climb once weaponization reaches automated tooling — and with this data profile (donations, health notes, family records), it will. The SQLi is the entry point; the payload is exactly the kind of data fraud chains prioritize.
For operations teams on shared hosting: understand that one compromised Church Admin installation on shared infrastructure becomes a pivot point to everything else that WordPress credentials reach. The blast radius of this vulnerability extends beyond your site to every neighbor on that server.
Here's what the CVE won't tell you: there's a ghost network of abandoned deployments — old staging sites, decommissioned hosting accounts, congregational sites where the church dissolved but the data persists. The EPSS measures live deployments; it doesn't account for forgotten copies still running vulnerable code. If you're responsible for auditing your environment, expand the scope beyond production. Check backups, staging, developer workstations, and any mirror you spun up and forgot about.
The real question for this population isn't emergency patching — it's whether the upgrade ever happens at all. Church Admin is overwhelmingly deployed by small congregations on shared hosting with no dedicated security staff. They're not monitoring CVE feeds. The coordination model that produced this disclosure assumes a defender ecosystem that can ingest and act on it. For thousands of these deployments, that actor doesn't exist. If you can patch, you're protecting people who can't protect themselves.