CVE-2026-84253

Summary

The click5 CRM add-on for Gravity Forms lacks proper authorization and CSRF protection when updating blog options through a REST endpoint, allowing unauthenticated attackers to modify arbitrary settings and create administrator accounts for complete site takeover.

Exploitability

Very easy to exploit with no prerequisites; attackers can directly call the vulnerable REST endpoint without authentication or CSRF tokens to modify any blog option.

Blast radius

High impact across all affected WordPress sites using this specific add-on version, potentially leading to full administrative control and data compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.0.4 or later of the click5 CRM add-on for Gravity Forms plugin

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.