click5 CRM Add-on CVE-2026-84252

Exploitation requires only that the target WordPress site has the click5 CRM add-on to WPForms (version ≤1.0.3) installed and active, exposing the vulnerable REST endpoint that updates options. No authentication (PR:N), no user interaction (UI:N), and no CSRF token are needed because the endpoint lacks both authorization and CSRF validation and fails to restrict updates to options owned by the add-on, so any blog option (including those enabling user registration or default roles leading to administrator creation) can be changed. The only real limiting factor is the presence/activation of this specific niche add-on; there are no default-configuration prerequisites or platform constraints beyond a standard WordPress install running the plugin.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper issue. All available signals align toward real risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes fully remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact (9.8 Critical), and the CWE-862 (Missing Authorization) root cause is consistent with the description of absent authorization and CSRF checks on a REST option-update endpoint. A public exploit exists (published by WPScan), which raises the practical likelihood of opportunistic mass scanning against WordPress sites running this add-on. The signals are internally consistent - network vector in the CVSS matches the REST-endpoint description, and PR:N matches the stated 'unauthenticated attackers.' The principal limiting factor is NOT exploitability but footprint: this is a specific CRM add-on to WPForms, so exposure depends on how many sites actually run this niche plugin. Key missing data: this CVE is NOT listed in CISA KEV and no EPSS score was provided, so there is no confirmation of active in-the-wild exploitation despite public POC availability - POC existence and active exploitation are distinct signals and must not be conflated. Treat as urgent-patch for any site confirmed to run the add-on.

An attacker identifies a WordPress site running the click5 CRM add-on to WPForms (≤1.0.3) and sends a crafted unauthenticated request to the vulnerable REST endpoint, which performs no authorization or CSRF validation and does not restrict which option is modified. The attacker overwrites core blog options (e.g. users_can_register and default_role, or injects an administrator user), then logs in with the newly created administrator account to fully take over the site. A public exploit for this flaw is available via WPScan, lowering the skill barrier.