CVE-2026-84252 click5 CVE debrief

Who should care

Defenders responsible for WordPress site security, particularly those using the click5 CRM add-on to WPForms WordPress plugin, should assess exposure and prioritize verification of the plugin version and monitoring for suspicious activity.

Why it matters

CVE-2026-84252 is a security vulnerability in the click5 CRM add-on to WPForms WordPress plugin that allows unauthenticated attackers to change arbitrary blog options. Defenders should prioritize verification of the plugin version and monitoring for suspicious activity to prevent potential site takeover.

• Potential creation of new administrator accounts by unauthenticated attackers
• Possible takeover of the WordPress site
• Need for verification of plugin version and security measures
• Importance of monitoring for suspicious blog option changes

Technical summary

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorization and CSRF checks when updating options via a REST endpoint. It also does not ensure that the option to be updated belongs to the plugin. This allows unauthenticated attackers to change arbitrary blog options, potentially creating a new administrator account and taking over the site. Defenders should prioritize verifying the version of the plugin and ensuring it is updated to a secure version. They should also monitor for suspicious activity related to blog option changes.

Defensive priority

Defenders should prioritize verifying the version of the click5 CRM add-on to WPForms WordPress plugin and ensuring it is updated to a secure version. They should also monitor for suspicious activity related to blog option changes.

Recommended defensive actions

• Verify the version of the click5 CRM add-on to WPForms WordPress plugin and update to a secure version if necessary
• Monitor for suspicious activity related to blog option changes
• Implement additional security measures to prevent unauthorized access to the WordPress site
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide information about the vulnerability in the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. However, details about affected versions, exploitation, and remediation are limited. Defenders should verify plugin version and monitor for suspicious activity related to blog option changes. Evidence from CVE Program and NVD detail page suggests unauthenticated attackers could change arbitrary blog options, potentially creating a new administrator account and taking over the site.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.