CVE-2026-84253: click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. No account, privileges, or user interaction are required.
What is the likely impact if exploitation succeeds?
An attacker can modify arbitrary WordPress blog options. This can allow creation of a new administrator account and complete site takeover.
Which plugin versions are affected?
The issue affects the click5 CRM add-on to Gravity Forms WordPress plugin through version 1.0.3.
How can I determine whether my site is exposed?
Check whether the click5 CRM add-on to Gravity Forms WordPress plugin is installed and whether its version is 1.0.3 or earlier. Sites meeting those conditions are affected according to the available information.