CVE-2026-84252: click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update

Q: Who is exposed to this issue?

WordPress sites using the click5 CRM add-on to WPForms plugin version 1.0.3 or earlier are affected. Exploitation can be performed remotely without authentication or user interaction.

Q: What does an attacker need to exploit it?

An attacker only needs network access to reach the vulnerable REST endpoint. No WordPress account, elevated privileges, or victim interaction is required.

Q: What could indicate that a site has already been compromised?

Unexpected changes to WordPress blog options or the presence of an unrecognized administrator account may indicate exploitation. The vulnerability can be used to alter arbitrary options and create an administrator account.

Published Oct 11, 2026

Updated

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

Affected Software

1 affected component

click5 CRM add-on to WPForms<=1.0.3

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using the click5 CRM add-on to WPForms plugin version 1.0.3 or earlier are affected. Exploitation can be performed remotely without authentication or user interaction.

What does an attacker need to exploit it?

An attacker only needs network access to reach the vulnerable REST endpoint. No WordPress account, elevated privileges, or victim interaction is required.

What could indicate that a site has already been compromised?

Unexpected changes to WordPress blog options or the presence of an unrecognized administrator account may indicate exploitation. The vulnerability can be used to alter arbitrary options and create an administrator account.

CVE-2026-84252: click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could indicate that a site has already been compromised?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could indicate that a site has already been compromised?