CVE-2026-84253
Received Received - Intake

Unauthenticated Option Update in Click5 CRM Gravity Forms Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-84253
EUVD
EUVD-2026-96755

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown click5 CRM add-on to Gravity Forms 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the click5 CRM add-on for Gravity Forms WordPress plugin up to version 1.0.3. It lacks authorization and CSRF checks in a REST endpoint, allowing unauthenticated attackers to modify any blog options. This could let them create a new admin account and take over the entire WordPress site.

Detection Guidance

Check if the click5 CRM add-on to Gravity Forms plugin version 1.0.3 or earlier is installed. Inspect WordPress REST API endpoints for unauthenticated POST requests modifying blog options. Look for suspicious administrator account creation or unauthorized option changes in the WordPress database.

Impact Analysis

If exploited, attackers could gain full control of your WordPress site by creating an admin account. This means they can modify content, install malicious plugins, steal data, or disrupt your website operations entirely.

Compliance Impact

This vulnerability allows unauthenticated attackers to modify arbitrary blog options, including creating new administrator accounts. This could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance requirements for data protection and access controls.

Mitigation Strategies

Update the click5 CRM add-on to Gravity Forms plugin to the latest version immediately. Disable the plugin if no update is available. Implement strict access controls for WordPress REST API endpoints. Monitor for unauthorized administrator accounts or option changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart