CVE-2026-84251: Ninja Forms Click5 CRM Auth Bypass Flaw

CVE-2026-84251 Overview

CVE-2026-84251 is a missing authorization vulnerability in the click5 CRM add-on for the Ninja Forms WordPress plugin through version 1.0.1. The plugin exposes a REST endpoint that updates WordPress options without authentication, authorization, or Cross-Site Request Forgery (CSRF) checks. The endpoint also fails to validate that the option being modified belongs to the plugin. Unauthenticated attackers can modify arbitrary blog options, register a new administrator account, and take full control of the affected WordPress site.

Critical Impact

Unauthenticated remote attackers can take over any WordPress site running the vulnerable plugin by creating administrator accounts through arbitrary option modification.

Affected Products

• click5 CRM add-on to Ninja Forms WordPress plugin, versions through 1.0.1
• WordPress sites with the vulnerable plugin installed and activated
• All hosting environments exposing the WordPress REST API to the internet

Discovery Timeline

• 2026-10-11 - CVE-2026-84251 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-84251

Vulnerability Analysis

The vulnerability is categorized as Missing Authorization [CWE-862]. The click5 CRM add-on registers a REST API endpoint that handles updates to WordPress options. The endpoint lacks a permission_callback that enforces capability checks and does not validate CSRF nonces on incoming requests.

The endpoint also fails to restrict which options can be updated. Instead of enforcing an allowlist of options owned by the plugin, it passes caller-supplied option names directly to the WordPress options API. This allows modification of any option stored in the wp_options table.

An attacker can abuse this to flip core WordPress settings such as users_can_register and default_role. Setting users_can_register to 1 and default_role to administrator allows anyone to self-register as a site administrator through the standard WordPress registration flow.

Root Cause

The root cause is the absence of authorization logic on a sensitive REST route combined with missing input validation on the target option name. The REST handler trusts unauthenticated input for both the operation and its target.

Attack Vector

Exploitation requires only network access to the WordPress REST API. The attacker sends a crafted HTTP request to the vulnerable REST endpoint to overwrite WordPress option values. After enabling self-registration and setting the default role to administrator, the attacker registers an account and inherits full site control. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-84251

Indicators of Compromise

• Unexpected changes to the users_can_register or default_role values in the wp_options table
• New administrator accounts in wp_users with no corresponding audit trail
• POST requests to click5 CRM REST routes under /wp-json/ originating from unauthenticated clients
• Modifications to siteurl, home, or admin_email options without an administrator session

Detection Strategies

• Monitor WordPress REST API access logs for unauthenticated POST requests to click5 CRM endpoints
• Alert on any change to users_can_register, default_role, siteurl, home, or admin_email options
• Baseline the list of administrator accounts and alert on additions outside change windows
• Review web server access logs for repeated requests to /wp-json/ paths followed by access to /wp-login.php?action=register

Monitoring Recommendations

• Enable WordPress audit logging to capture option changes and user role assignments
• Forward web server and WordPress logs to a central analytics platform for correlation
• Track creation of privileged accounts and tie events back to the originating IP address and user agent

How to Mitigate CVE-2026-84251

Immediate Actions Required

• Deactivate and remove the click5 CRM add-on for Ninja Forms until a patched version is published
• Audit the wp_users table for unauthorized administrator accounts and remove them
• Verify that users_can_register is set to 0 unless open registration is required
• Rotate credentials and secrets for any existing administrator accounts on affected sites

Patch Information

As of the latest NVD update, no fixed version has been published for the click5 CRM add-on. Monitor the WPScan Vulnerability Report and the plugin vendor for a security release. Remove the plugin until a fix is available.

Workarounds

• Block access to the vulnerable REST endpoint at the web application firewall or reverse proxy
• Disable the WordPress REST API for unauthenticated users where feasible
• Restrict access to /wp-json/ paths by IP allowlist for administrative networks only
• Set users_can_register to 0 and default_role to subscriber to limit impact if the endpoint is reached

# Example WP-CLI commands to harden option values
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin deactivate click5-crm-ninja-forms
wp plugin delete click5-crm-ninja-forms