EUVD-2026-96755
GHSA-2w6p-xhgg-wwf6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable add-on
-
DeliverySend unauthenticated REST request
-
ExploitBypass missing authz/CSRF checks
-
ExecutionOverwrite arbitrary blog options
-
PersistCreate rogue administrator account
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the click5 CRM add-on to Gravity Forms (version ≤1.0.3) installed and active on a WordPress site - the vulnerable REST endpoint is remotely reachable and requires no authentication, no CSRF token, and no user interaction against a default configuration. The only limiting factor is deployment of this specific add-on; because the option-update routine does not verify authorization or that the target option belongs to the add-on, any reachable site with the plugin active is exploitable without further prerequisites. |
| Impact | All signals align toward genuine high priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remote, network-reachable, low-complexity flaw requiring no privileges and no user interaction, which is fully consistent with the description of an unauthenticated REST endpoint missing both authorization (CWE-862) and CSRF protection. Publicly available exploit code exists (reported by WPScan), which materially raises real-world risk beyond the raw score, because the outcome - arbitrary blog option changes leading to rogue administrator creation and full site takeover - is a complete compromise of the WordPress instance. No EPSS score, SSVC decision data, or KEV listing was provided; the vulnerability is NOT in CISA KEV, so there is no confirmation of active in-the-wild exploitation despite the published POC. The main mitigating factor is prevalence: this is a niche third-party CRM add-on for Gravity Forms, so the aggregate attack surface is far smaller than a core plugin. Net: treat as a high-urgency patch where the add-on is installed, but the limited install base likely means targeted rather than mass exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the vulnerable click5 CRM REST endpoint, which fails to verify authorization or CSRF and does not restrict which option is written. They overwrite a sensitive WordPress option (e.g. users_can_register plus default_role=administrator, or inject an admin user) to create a new administrator account and seize full control of the site. A public POC from WPScan already exists, and the AV:N/AC:L/PR:N/UI:N vector means this works remotely against a default install with no credentials or victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated option manipulation in the click5 CRM add-on to Gravity Forms (versions up to and including 1.0.3) lets any remote attacker rewrite arbitrary WordPress blog options and escalate to complete site takeover by enabling open registration with an administrator default role, thereby creating a new admin account. The flaw is a missing authorization/CSRF class issue exposed through a REST endpoint that neither checks the caller's capabilities nor verifies that the targeted option belongs to the add-on, so no credentials, nonce token, or user interaction are required against a default configuration. Publicly available exploit code exists, and the only real prerequisite is that the affected add-on be installed and active on a reachable WordPress site; no CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed.
RemediationAI
No vendor-released patch version was identified in the available intelligence at the time of analysis, so the most reliable immediate action is to deactivate and remove the click5 CRM add-on to Gravity Forms from every WordPress installation where it is enabled; if the add-on is business-critical and cannot be removed, isolate the site behind an access control layer so that only trusted IP ranges can reach /wp-json/ and the site front end, accepting the operational trade-off that public visitors and third-party integrations will be blocked. Blocking unauthenticated POST requests to the WordPress REST API at the web server or WAF layer (for example, denying POSTs to /wp-json/ that lack a valid authentication cookie or nonce) reduces exposure but will break legitimate form submissions and headless clients, so it should be scoped to the add-on's route namespace if one can be identified. As compensating detective and containment controls, immediately audit wp_options for unexpected changes to users_can_register, default_role, admin_email, and siteurl, review the wp_users and wp_usermeta tables for newly created administrator accounts, and rotate authentication salts and all administrator passwords if any unauthorised option change is found, since the same primitive allows an attacker to establish persistent admin access. Enforce two-factor authentication for administrators and, where feasible, define roles so that newly registered users cannot receive elevated capabilities. Monitor the WPScan advisory at https://wpscan.com/vulnerability/7df795df-1b4c-4b82-84ec-4a14d82592e5/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-84253 for a fixed version; no fixed release is named in the current references, and publicly available exploit code exists, which raises the urgency of removing or fencing off the plugin rather than waiting for a patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is a WordPress plugin - the click5 CRM add-on to Gravity Forms - and the root cause maps to CWE-862 (Missing Authorization). WordPress exposes registered plugin functionality through the REST API under /wp-json/, and each route should enforce a permission_callback plus, for state-changing requests, a nonce/CSRF check. In this add-on (through 1.0.3) an options-update REST route performs neither: it does not verify that the requester holds the manage_options capability, does not validate a CSRF token, and does not constrain the option key to those owned by the add-on. Because the underlying handler writes directly through the WordPress options API, the attacker controls the option name as well as its value, which means core settings such as user registration enablement and the default role assigned to newly registered users can be modified. Turning on registration with a default role of administrator, or similar core option rewrites, converts an otherwise low-privilege anonymous request into persistent administrative access. The CVE record carries an unresolved vendor CPE (cpe:2.3:a:unknown:click5_crm_add-on_to_gravity_forms:*:*:*:*:*:*:*:*), and ENISA's EUVD entry (EUVD-2026-96755) lists the affected range as all versions from 0 through 1.0.3, which is consistent with the '*' version wildcard and indicates no fixed release exists within the enumerated range. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a remotely reachable, unauthenticated, low-complexity attack against the vulnerable component itself that yields high confidentiality and integrity impact without requiring any user to be tricked into an action.
Know when Click5 Crm Add On To Gravity Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote REST endpoint with no authz/CSRF (PR:N, UI:N, AC:L, AV:N); arbitrary option write enabling admin takeover yields full C/I/A impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Technical POC Analysis
Bug class: CWE-862, Missing Authorization.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A critical flaw in the click5 CRM add-on for Gravity Forms (all versions through 1.0.3) lets a remote attacker gain complete control of an affected WordPress site, including creating new administrator accounts - putting the organization's public web presence, customer records stored in WordPress, and any connected business systems at risk. Exploit code is publicly available and no vendor fix has been identified, so exposure cannot be closed by routine patching; leadership should treat every internet-reachable site running this add-on as a priority containment and monitoring item.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the click5 CRM add-on for Gravity Forms (versions up to and including 1.0.3); where it must remain active, block external access to its REST endpoint via WAF or reverse-proxy rule, disable open registration, enforce a non-privileged default role for new users, enable multi-factor authentication for administrators, remove or restrict the /wp-json/ attack surface, and monitor wp_users and wp_options for unauthorized admin account creation or option tampering.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB