click5 CRM add-on to Ninja Forms: Unauthenticated arbitrary options update
Summary
The click5 CRM add-on for the Ninja Forms WordPress plugin, up to and including version 1.0.1, lacks authorisation and CSRF checks on a REST endpoint that updates WordPress options. An unauthenticated attacker can change arbitrary blog options, for example to create a new administrator account and take over the website. No login or user interaction is required, and the CVSS score is 9.8 (critical).
Affected
- click5 CRM add-on to Ninja Forms, versions 0 to 1.0.1 (WordPress plugin, slug click5-crm-add-on-to-ninja-forms)
- Vendor: Unknown
Fixed in
Unknown. WPScan lists 'No known fix'. A VulDB AI-generated analysis mentions version 1.0.2, but this could not be verified.
Workaround
- Deactivate and delete the add-on if the CRM integration is not essential.
- If the integration is needed, restrict access to the plugin's REST routes at the web application firewall or reverse proxy and test the form-to-CRM flow.
- Review administrator accounts, recently changed site options and unexpected plugins or files.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV according to one third-party tracker.
- EPSS about 0.1%.
- Public proof of concept: unclear.
- No reports of in-the-wild exploitation found.
Our recommendation
- Search client WordPress installations for the plugin slug click5-crm-add-on-to-ninja-forms.
- Where found, deactivate and remove the plugin unless it is business-critical.
- Audit administrator accounts and site options, even after removal, because the flaw may already have been used.
- Watch for a vendor fix and verify it before reinstalling.
- Keep WordPress core and Ninja Forms up to date.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- OpenCVE CVE-2026-84251 app.opencve.io
- Vulners NVD CVE-2026-84251 vulners.com
- VulDB CVE-2026-84251 vuldb.com
- Plugin listing (commoninja) discover.commoninja.com
- Sibling entry WPScan CVE-2026-84258 wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:17.
Original description (NVD)
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.