CVE-2026-84251

Summary

The click5 CRM add-on for Ninja Forms plugin lacks proper authorization and CSRF protection when updating options via its REST endpoint, allowing unauthenticated attackers to modify arbitrary blog settings and create administrator accounts for complete site takeover.

Exploitability

Very easy to exploit with no prerequisites; attackers only need to send a crafted request to the vulnerable REST endpoint to update any blog option.

Blast radius

High impact across all affected WordPress sites using the click5 CRM add-on, potentially leading to full administrative control and data compromise.

Detection

Monitor for unusual REST API requests to the /wp-json/ninja-forms/v1/click5 endpoint with POST method, particularly those modifying core WordPress options like wp_options table entries, and look for new administrator user creation attempts in the WordPress admin logs.

Prioritized remediation

Disable the click5 CRM add-on plugin immediately or upgrade to version 1.0.2 which contains the authorization and CSRF fixes for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.