CVE-2026-84251
Received Received - Intake

Unauthenticated Option Update in Click5 CRM for Ninja Forms

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-84251
EUVD
EUVD-2026-96753

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown click5 CRM add-on to Ninja Forms 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the click5 CRM add-on for Ninja Forms WordPress plugin version 1.0.1 or lower. It lacks authorization and CSRF checks in a REST endpoint, allowing unauthenticated attackers to update arbitrary blog options. This can lead to creating a new administrator account and full site takeover.

Detection Guidance

Check if the click5 CRM add-on to Ninja Forms plugin version 1.0.1 or lower is installed. Look for unauthorized changes in WordPress blog options or new administrator accounts.

Impact Analysis

An attacker could exploit this to modify critical settings, create an admin account, and gain full control of your WordPress site without authentication. This could result in data theft, malware installation, or defacement of your website.

Compliance Impact

This vulnerability could lead to unauthorized access and control of a WordPress site, potentially exposing sensitive data stored in the CRM or other plugins. If personal data is involved, this could violate GDPR requirements for data protection and user consent. For HIPAA, if the site handles protected health information, unauthorized access could result in breaches of confidentiality and security rules.

Mitigation Strategies

Disable the click5 CRM add-on to Ninja Forms plugin immediately. Monitor for unauthorized administrator accounts. Apply updates once a patched version is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84251. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart