CVE-2026-84254 in Contact Form 7 Plugin
Summary
by MITRE • 10/11/2026
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in the Click5 CRM add-on for the Contact Form 7 WordPress plugin, specifically affecting versions through 1.0.4, represents a critical failure in access control mechanisms within the application's REST API implementation. This flaw stems from an absence of both authentication and Cross-Site Request Forgery (CSRF) validation when processing requests intended to update configuration options via exposed endpoints. In secure web applications, any endpoint that modifies state or alters system configurations must strictly verify the identity of the requester and ensure that the request originates from a legitimate source within the same context as the user's session. The failure to implement these checks allows external actors to interact with administrative functions without possessing valid credentials, effectively bypassing the fundamental security boundary designed to protect sensitive site data.
From a technical perspective, this vulnerability is classified under CWE-284, which denotes Improper Access Control, and more specifically aligns with CWE-352 regarding Cross-Site Request Forgery. The core issue lies in the server-side logic that processes REST API calls for option updates. Instead of validating whether the authenticated user has the requisite privileges to modify specific settings or verifying the integrity of the request through anti-CSRF tokens, the application accepts and executes these commands from any source. Furthermore, the lack of validation ensures that there is no check confirming that the targeted configuration key actually belongs to the Click5 CRM add-on itself. This oversight allows attackers to manipulate arbitrary blog options rather than being restricted solely to the intended plugin settings, significantly expanding the attack surface beyond the immediate scope of the vulnerable component.
The operational impact of this vulnerability is severe and directly leads to full site compromise. Because WordPress REST endpoints often allow for broad administrative actions when properly authenticated, an unauthenticated attacker can exploit this flaw to modify critical system parameters. Most notably, attackers can leverage this capability to create a new user account with administrator privileges. Once such an account is established, the attacker gains complete control over the website environment. This level of access permits the installation of malicious plugins, modification of core files, theft of sensitive data stored in the database, and further exploitation of other users or connected systems. The ability to take over a site without prior authentication makes this vulnerability particularly dangerous for public-facing WordPress installations that may not have additional layers of security such as IP whitelisting or advanced WAF rules blocking unauthenticated API access.
To mitigate this risk, immediate action is required by updating the Click5 CRM add-on and Contact Form 7 to their latest patched versions where these authorization checks are properly implemented. Administrators should also review server configurations to restrict REST API access if possible, ensuring that only authenticated requests with valid nonces or tokens can modify site options. Implementing strict input validation on the backend to verify that update operations target only whitelisted configuration keys associated with the specific plugin would further harden the application against arbitrary option manipulation. Regular security audits and adherence to secure coding standards such as OWASP API Security Top 10 are essential to prevent similar access control failures in future development cycles, ensuring that all state-changing endpoints enforce robust authentication and authorization protocols.