CVE-2026-84252 in Click5 CRM Add-on to WPForms Plugin
Summary
by MITRE • 10/11/2026
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in the click5 CRM add-on for WPForms affects versions up to 1.0.3 and represents a critical failure in access control mechanisms within the WordPress ecosystem. This flaw is rooted in the REST API endpoint responsible for updating plugin options, which lacks both authentication verification and Cross-Site Request Forgery protections. In standard web application security architecture, any state-changing operation must verify that the requester has valid credentials and possesses a legitimate session token to prevent unauthorized modifications. The absence of these checks means that the server processes configuration changes from any source without validating the identity or intent of the caller, effectively treating unauthenticated requests with the same trust level as authenticated administrative actions.
From a technical perspective, this deficiency allows for an arbitrary option update attack where an attacker can manipulate core WordPress settings by exploiting the lack of scope validation on the targeted REST endpoint. The application fails to ensure that the specific options being modified are restricted to those belonging exclusively to the click5 CRM add-on itself. Instead, it accepts updates for any configurable key within the WordPress database structure associated with plugin options. This architectural oversight enables an attacker to overwrite critical system parameters rather than just plugin-specific configurations, thereby escalating their privileges from a non-existent or low-privilege state to full administrative control over the web application.
The operational impact of this vulnerability is severe, as it directly facilitates complete site compromise through privilege escalation. By manipulating blog options via the vulnerable endpoint, an attacker can create a new user account with administrator-level capabilities. Once such an account exists and is logged in, the attacker gains unrestricted access to all aspects of the WordPress installation, including themes, plugins, database content, and server-side files. This level of control allows for further malicious activities such as defacement, data exfiltration, malware injection, or using the compromised site as a pivot point for attacks against other systems on the network. The ease of exploitation due to the lack of authentication makes this vulnerability particularly dangerous in automated scanning environments where bots can rapidly identify and exploit vulnerable instances.
This flaw aligns with CWE-284 Improper Access Control, specifically reflecting failures in authorization checks that allow unauthorized users to perform privileged functions. Additionally, it maps to MITRE ATT&CK technique T1078 Valid Accounts, as the attacker leverages a vulnerability to establish persistent valid credentials for administrative access. The lack of CSRF protection also relates to CWE-352 Cross-Site Request Forgery, although in this context, the primary risk is driven by the absence of authentication rather than just session hijacking via forged requests from other domains.
Mitigation strategies must prioritize immediate remediation through software updates and defensive configuration changes. The most effective solution is to upgrade the click5 CRM add-on for WPForms to a version that includes proper authorization checks, CSRF token validation, and strict scoping of REST API endpoints to only allow modification of intended plugin-specific options. Until an update is available or applied, administrators should restrict access to WordPress admin areas using IP whitelisting if possible and ensure that all plugins are kept up to date with security patches provided by the vendor. Additionally, implementing a Web Application Firewall can help detect and block suspicious REST API calls that attempt to modify critical system options without valid authentication headers.