CVE-2026-84254

Summary

The click5 CRM add-on for Contact Form 7 plugin lacks proper authorization and CSRF protection when updating options through its REST endpoint, allowing unauthenticated attackers to modify arbitrary blog settings and create administrator accounts for complete site takeover.

Exploitability

Exploitation is straightforward with no prerequisites, as the vulnerability allows unauthenticated attackers to directly modify any blog option through a known REST endpoint.

Blast radius

The impact could be severe across all affected WordPress sites using Contact Form 7 plugin version 1.0.4 or earlier with the click5 CRM add-on installed, potentially leading to complete site compromise and unauthorized administrative access.

Detection

Monitor for unusual REST API requests to /wp-json/cf7crm/v1/options endpoint with elevated privileges, particularly those modifying core WordPress options like wp_options table entries related to user roles or authentication settings.

Prioritized remediation

Upgrade to Contact Form 7 plugin version 1.0.5 or later which includes proper authorization and CSRF checks for the click5 CRM add-on REST endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.