{"id":"CVE-2026-84251","published":"2026-10-11T07:17:24.820","lastModified":"2026-10-13T20:36:00.850","description":"The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/db54e1a5-51bc-431d-9a9e-9fa3ac96a817/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The click5 CRM add-on for Ninja Forms plugin lacks proper authorization and CSRF protection when updating options via its REST endpoint, allowing unauthenticated attackers to modify arbitrary blog settings and create administrator accounts for complete site takeover.","exploitability":"Very easy to exploit with no prerequisites; attackers only need to send a crafted request to the vulnerable REST endpoint to update any blog option.","blast_radius":"High impact across all affected WordPress sites using the click5 CRM add-on, potentially leading to full administrative control and data compromise.","remediation":"Disable the click5 CRM add-on plugin immediately or upgrade to version 1.0.2 which contains the authorization and CSRF fixes for this vulnerability.","detection":"Monitor for unusual REST API requests to the /wp-json/ninja-forms/v1/click5 endpoint with POST method, particularly those modifying core WordPress options like wp_options table entries, and look for new administrator user creation attempts in the WordPress admin logs.","tags":["auth-bypass","rest-api","wordpress","crm"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:50:25.410Z"}}