click5 CRM Add-on CVE-2026-84251

No special conditions beyond having the vulnerable component installed - remote unauthenticated exploitation is possible against default configurations of any WordPress site running the click5 CRM add-on to Ninja Forms through version 1.0.1. The specific prerequisite is that this add-on is installed and active, exposing its REST endpoint that updates options without authorisation checks, without CSRF validation, and without verifying that the targeted option actually belongs to the add-on (permitting arbitrary blog-option writes). Limiting factors: only sites with this particular add-on are affected (not Ninja Forms core alone), and the absolute exposure is constrained by the add-on's niche deployment rather than by any authentication, user-interaction, or non-default-configuration requirement.

This is a genuine high-priority vulnerability, not a high-CVSS/low-real-risk artifact. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, and the CWE-862 (Missing Authorization) classification is fully consistent with the description of an unprotected REST endpoint lacking authorisation and CSRF checks. The impact triad C:H/I:H/A:H is credible because the flaw permits changing arbitrary blog options to create a rogue administrator account, i.e. full site takeover. Exploitation status: publicly available exploit code exists (POC flagged by WPScan); this is NOT evidence of active in-the-wild exploitation - the CVE is not listed in CISA KEV in the provided data. EPSS is not provided, so widespread-scanning probability cannot be quantified from the input; however, the combination of a public POC, trivial unauthenticated vector, and a well-understood 'create admin via options update' primitive typical of WordPress plugin bugs makes opportunistic mass exploitation realistic once sites are indexed. The main dampening factor is deployment footprint: this is a niche add-on, not a core WordPress component, so the absolute population of exposed sites is likely small. Net: patch/mitigate promptly on any affected install, but overall internet-wide urgency is bounded by low prevalence rather than by technical difficulty.

An unauthenticated attacker sends a crafted request to the plugin's unprotected REST endpoint to overwrite WordPress blog options (e.g. enabling user registration and setting the default role to administrator, or directly inserting admin-level option values), then registers or escalates an account to administrator and logs in to fully control the site. Because there are no authorisation or CSRF checks and the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, tokens, or victim interaction are needed. A public POC is available via WPScan, lowering the barrier to weaponisation.