Click To Pray, a prayer application endorsed by the Pope’s Worldwide Prayer Network, has exposed personal data of more than 700,000 registered users due to an insecure direct object reference vulnerability, according to a security researcher who reported the issue in January.

The app, available in seven languages on iOS, Android, and clicktopray.org, serves as the official platform of the Pope’s Worldwide Prayer Network and had 719,517 accounts as of July 2026.

The vulnerability allows any user with a valid five‑digit account identifier to request data for any other account via the API endpoint https://api.clicktopray.org/user/users/{id}. The endpoint does not verify ownership or enforce authentication, enabling enumeration of all accounts by incrementing the identifier, a practice the researcher described as feasible with a simple script.

The exposed records include email addresses, names, country, dates of birth, and deletion status. The researcher said the sequential IDs and lack of rate limiting make the platform a potential phishing target, especially for older or less technically savvy users.

The sign‑up endpoint returns a validation hash that is also used in email verification links, allowing an attacker to create accounts with any email address and verify them before the official confirmation email is received. Additionally, the researcher’s email client flagged the verification email as failing domain authentication, suggesting it could be spoofed.

The Register contacted the Pope’s Worldwide Prayer Network for comment and received no reply. The researcher continues to seek a response.

No official statement has been issued regarding the security flaw, and the researcher has indicated she will keep monitoring the situation.