click5 CRM Add-on EUVD-2026-96756

The target must be a WordPress site running the click5 CRM add-on to Contact Form 7 at version 1.0.4 or earlier, with the vulnerable REST endpoint reachable (the default state, since it lacks any authorization or CSRF check). No authentication, no valid nonce/CSRF token, and no user interaction are required (confirmed by PR:N/UI:N). The only real limiting factor is deployment: the specific add-on must be installed and active - Contact Form 7 alone, or WordPress without this add-on, is not affected. Full takeover via the administrator-creation path also presupposes that WordPress user registration can be toggled on through the arbitrary-option write, which the described flaw permits.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is fully consistent with the description: a REST endpoint lacking both authorization and CSRF checks is reachable by unauthenticated attackers over the network with low complexity and no user interaction. CWE-862 (Missing Authorization) directly matches the root cause. The signals reinforce rather than conflict: a missing-authorization flaw that permits writing arbitrary blog options (and thus creating an administrator) yields full confidentiality, integrity, and availability impact (C:H/I:H/A:H), so the 9.8 rating is defensible. POC/exploit code is publicly available per WPScan, which raises near-term risk. No EPSS score was provided and the CVE is NOT listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation - the elevated concern rests on the trivial exploitability and public POC rather than observed attacks. The main tempering factor is deployment footprint: this affects a specific CRM add-on to Contact Form 7, not Contact Form 7 or WordPress core itself, so exposure is limited to sites running that particular add-on (≤1.0.4).

An unauthenticated attacker sends a crafted request to the add-on's unprotected REST option-update endpoint and overwrites core WordPress options such as the default registration role and user-registration setting, then registers a new account that is automatically granted administrator privileges. Because publicly available exploit code exists and no authentication or CSRF token is required, the attacker gains full site takeover remotely. The low attack complexity (AC:L) and no-user-interaction requirement make mass or opportunistic exploitation straightforward against any exposed vulnerable site.