CVE-2026-84253 in click5 CRM add-on to Gravity Forms Plugin
Summary
by MITRE • 10/11/2026
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in the Click5 CRM add-on for the Gravity Forms WordPress plugin version 1.0.3 represents a critical failure in access control mechanisms within the application's REST API implementation. This flaw allows unauthenticated actors to manipulate arbitrary blog options, which serves as a direct pathway to full site compromise. The core technical deficiency lies in the absence of both authorization checks and Cross-Site Request Forgery (CSRF) protections on specific endpoints responsible for updating configuration settings. In secure web application design, any endpoint that modifies state or updates data must verify that the requesting user possesses the necessary privileges to perform such actions. Furthermore, CSRF protection is essential to ensure that requests originate from legitimate users interacting with the site through its intended interface, rather than being forged by malicious third-party sites or scripts. The complete omission of these security controls means that any entity on the internet can send a crafted HTTP request to modify critical system parameters without providing valid credentials or session tokens.
The specific technical flaw involves the REST endpoint's inability to validate whether the options being updated actually belong to the Click5 CRM add-on itself, nor does it restrict access based on user roles. This lack of object-level authorization and role-based access control creates a scenario where an attacker can overwrite arbitrary WordPress blog options. By manipulating these low-level configuration settings, attackers can exploit the inherent trust relationships within the WordPress platform. For instance, by altering specific option values in the wp_options database table, it is possible to inject or modify user data structures that define administrative privileges. This capability effectively bypasses standard authentication workflows because the attacker does not need to guess passwords or hijack sessions; they simply alter the system's definition of who holds administrator rights.
The operational impact of this vulnerability is severe and results in complete loss of integrity for the affected WordPress installation. An unauthenticated attacker can leverage this flaw to create a new user account with administrative privileges, thereby gaining full control over the website. Once an admin account is established under the attacker's control, they can execute arbitrary code, install malicious plugins, deface the site, or use it as a pivot point for further attacks against internal networks and other connected systems. This type of vulnerability falls squarely under CWE-284 Improper Access Control and CWE-352 Cross-Site Request Forgery (CSRF). From an offensive security perspective, this behavior aligns with MITRE ATT&CK techniques related to Account Manipulation and Privilege Escalation, specifically T1098.004 which involves SSH Authorized Keys Modification or more broadly account creation for persistence. The ability to create admin accounts without authentication is a classic example of how missing access controls can lead to total system compromise.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene practices. The primary remediation step is to upgrade the Click5 CRM add-on to version 1.0.4 or later, where these authorization and CSRF checks have been implemented by the developers. Until an update is applied, site administrators should consider disabling REST API access for unauthenticated users if possible, although this may impact legitimate functionality depending on how the plugin integrates with other services. Additionally, implementing a Web Application Firewall (WAF) can provide temporary protection by filtering out malicious requests that attempt to modify critical WordPress options via non-standard endpoints or lack valid CSRF tokens. Regular security audits and penetration testing of custom plugins are essential to identify similar gaps in access control logic before they can be exploited in production environments. Ensuring that all REST endpoints enforce strict role-based access controls and validate the origin of state-changing requests is fundamental to maintaining a secure WordPress infrastructure.