CVE-2026-84254 click5 CVE debrief

Who should care

Defenders responsible for WordPress installations using the click5 CRM add-on to Contact Form 7 WordPress plugin should assess exposure and prioritize verification and potential updates.

Why it matters

CVE-2026-84254 allows unauthenticated attackers to change arbitrary blog options in WordPress installations using the vulnerable click5 CRM add-on to Contact Form 7 WordPress plugin. Defenders should verify exposure, prioritize updates, and monitor for unauthorized changes.

• Potential unauthorized changes to blog options by unauthenticated attackers.
• Possible creation of new administrator accounts.
• Site takeover by attackers exploiting this vulnerability.
• Verification of plugin version and presence in WordPress installations is required.

Technical summary

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorization and CSRF checks when updating options via a REST endpoint. It also does not ensure that the option to be updated belongs to the plugin. This allows unauthenticated attackers to change arbitrary blog options, potentially creating a new administrator account and taking over the site. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and updating the plugin to a fixed version if available.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and updating the plugin to a fixed version if available.

Recommended defensive actions

• Verify the presence of the click5 CRM add-on to Contact Form 7 WordPress plugin version 1.0.4 or earlier in your WordPress installation.
• Update the plugin to a fixed version if available.
• Monitor for unauthorized changes to blog options.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4, but there is limited information on affected versions, exploitation, or remediation. Defenders should verify plugin version and presence in WordPress installations, and monitor for unauthorized changes. Evidence is limited; further verification tasks are required to ensure exposure and impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.