{"id":"CVE-2026-84252","published":"2026-10-11T07:17:24.943","lastModified":"2026-10-13T20:36:00.850","description":"The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/ab64adf8-a07e-491b-9a47-d195e0e543c3/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The click5 CRM add-on for WPForms WordPress plugin lacks proper authorization and CSRF protection when updating options via its REST endpoint, allowing unauthenticated attackers to modify arbitrary blog settings and create administrator accounts for full site takeover.","exploitability":"Very easy to exploit with no prerequisites; attackers need only send a crafted request to the vulnerable REST endpoint to update any blog option.","blast_radius":"High impact across all WordPress sites using the affected click5 CRM add-on version 1.0.3, potentially leading to complete site compromise and unauthorized administrative access.","remediation":"Disable the click5 CRM add-on plugin immediately or upgrade to version 1.0.4 which contains the authorization and CSRF fixes for this vulnerability.","detection":"Monitor for unusual REST API requests to /wp-json/wpforms/v1/click5/ endpoints with elevated privileges, particularly those modifying core WordPress options like wp_options table entries.","tags":["auth-bypass","rest-api","wpforms","crm"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:50:32.373Z"}}