CVE-2026-84252
Received Received - Intake

Unauthenticated Option Update in Click5 CRM for WPForms

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-84252
EUVD
EUVD-2026-96754

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown click5 CRM add-on to WPForms 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the click5 CRM add-on for WPForms WordPress plugin version 1.0.3 or lower. It lacks authorization and CSRF checks in a REST endpoint, allowing unauthenticated attackers to modify any blog options. This could let them create a new administrator account and take full control of the WordPress site.

Detection Guidance

Check if the click5 CRM add-on to WPForms plugin version 1.0.3 or lower is installed. Inspect WordPress REST API endpoints for unauthorized option updates. Monitor for unexpected administrator account creations or changes to blog options.

Impact Analysis

An attacker could exploit this to change critical settings on your WordPress site, create an admin account, and take complete control. This could lead to data theft, defacement, or further attacks on visitors.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Disable the click5 CRM add-on to WPForms plugin immediately. Implement strict access controls for WordPress REST API endpoints. Regularly audit user accounts and blog options for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart