CVE-2026-84252
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Risk Assessment
An attacker can gain full control of the WordPress site by creating an admin account and modifying settings, potentially leading to integrity and availability compromise.
Recommendation
Update the click5 CRM add-on to WPForms to the latest patched version. Additionally, restrict access to REST endpoints and implement additional authorization mechanisms.
Other vulnerabilities in click5 CRM add-on to WPForms
Original NVD description (English source)
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS