Authorization and CSRF Flaw in Click5 CRM Add-on for Ninja Forms by WordPress
CVE-2026-84251

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Click5 Crm Add-on To Ninja Forms
Vendor
CVE Published:
11 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-84251?

The Click5 CRM add-on for the Ninja Forms plugin in WordPress lacks proper authorization and CSRF protection when updating options via its REST endpoint. This oversight allows unauthenticated attackers to manipulate blog options freely. An attacker could exploit this vulnerability to change arbitrary options, leading to the creation of a new administrator account, which could ultimately grant full control over the WordPress site.

Affected Version(s)

click5 CRM add-on to Ninja Forms 0 <= 1.0.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-84251 - Proof of Concept

References

https://wpscan.com/vulnerability/db54e1a5-51bc-431d-9a9e-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini - Claudio Marchesini - Dottor Marc
WPScan
.