CVE-2026-84252

Summary

The click5 CRM add-on for WPForms WordPress plugin lacks proper authorization and CSRF protection when updating options via its REST endpoint, allowing unauthenticated attackers to modify arbitrary blog settings and create administrator accounts for full site takeover.

Exploitability

Very easy to exploit with no prerequisites; attackers need only send a crafted request to the vulnerable REST endpoint to update any blog option.

Blast radius

High impact across all WordPress sites using the affected click5 CRM add-on version 1.0.3, potentially leading to complete site compromise and unauthorized administrative access.

Detection

Monitor for unusual REST API requests to /wp-json/wpforms/v1/click5/ endpoints with elevated privileges, particularly those modifying core WordPress options like wp_options table entries.

Prioritized remediation

Disable the click5 CRM add-on plugin immediately or upgrade to version 1.0.4 which contains the authorization and CSRF fixes for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.