CVE-2026-84254
Received Received - Intake

Unauthenticated Option Update in Click5 CRM WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-84254
EUVD
EUVD-2026-96756

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown click5 CRM add-on to Contact Form 7 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the click5 CRM add-on to Contact Form 7 WordPress plugin (version 1.0.4 or earlier) allows unauthenticated attackers to modify any blog option via a REST endpoint due to missing authorization and CSRF checks. This flaw enables attackers to create a new administrator account and take full control of the WordPress site.

Detection Guidance

Check if the click5 CRM add-on to Contact Form 7 plugin version 1.0.4 or earlier is installed. Inspect WordPress REST API endpoints for unauthenticated POST requests modifying arbitrary options. Look for unexpected administrator account creations or changes to blog settings.

Impact Analysis

This vulnerability allows attackers to take over your WordPress site by creating an administrator account. They can modify site settings, steal data, install malicious plugins, or deface the website. Since no authentication is required, any visitor could exploit this issue.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. A successful attack may result in non-compliance, legal penalties, and reputational damage due to compromised user data.

Mitigation Strategies

Immediately update the click5 CRM add-on to the latest version if available. If no update exists, consider disabling the plugin until a patch is released. Monitor for unauthorized administrator accounts and review WordPress logs for suspicious REST API activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart