click5 CRM add-on to Gravity Forms: Unauthenticated arbitrary options update
Summary
The click5 CRM add-on to Gravity Forms, a WordPress plugin, lacks authorisation and CSRF checks on a REST endpoint that updates WordPress options and does not verify that the option belongs to the add-on. An unauthenticated attacker can change arbitrary blog options, for example to create a new administrator account and take over the site. No login or user interaction is required, and the CVSS score is 9.8 (critical).
Affected
- click5 CRM add-on to Gravity Forms (slug gf-add-on-by-click5), all versions through 1.0.3
Fixed in
- Unknown. WPScan lists no known fix. No vendor advisory was found.
Workaround
- Deactivate and remove the add-on if the CRM sync is not business-critical; this is the most direct option.
- Restrict access to the WordPress REST API where practical and use a WAF or virtual patch as a compensating control; validate any rule before relying on it.
- Keep WordPress core and Gravity Forms updated; this does not fix the add-on flaw.
Exploitation
- Not listed in CISA KEV. EPSS is about 0.1%.
- CISA SSVC: automatable yes, technical impact total.
- A proof-of-concept label is shown on WPScan, but its content could not be verified; VulDB reports no available exploit.
- No in-the-wild exploitation is known.
Our recommendation
- If the add-on is installed on any site, remove it or isolate the site now; do not wait for a patch.
- Check for unexpected administrator accounts and recently changed options.
- Review related add-ons from the same developer (CVE-2026-84254 in the Contact Form 7 add-on, CVE-2026-84260 stored XSS), which also have no known fix.
- Monitor the WordPress.org plugin page and the vendor for a fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- NVD data via Vulners vulners.com
- VulDB entry vuldb.com
- VulnCheck Vulnrichment summary vulners.com
- EPSS and KEV status (GitHub issue) github.com
- Contact Form 7 add-on WPScan entry wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:14.
Original description (NVD)
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.