CVE-2026-84252 Overview
CVE-2026-84252 is a missing authorization vulnerability in the click5 CRM add-on to WPForms WordPress plugin through version 1.0.3. The plugin exposes a REST endpoint that updates WordPress options without authentication, authorization, or Cross-Site Request Forgery (CSRF) checks. The endpoint also fails to restrict which options can be modified. Unauthenticated attackers can change arbitrary blog options, create a new administrator account, and take over the site. The flaw is classified under CWE-862: Missing Authorization.
Critical Impact
Unauthenticated remote attackers can modify arbitrary WordPress options, create administrator accounts, and achieve full site takeover.
Affected Products
- click5 CRM add-on to WPForms WordPress plugin, all versions through 1.0.3
- WordPress sites running the vulnerable plugin with the REST endpoint reachable
- Any WordPress deployment where the add-on is active and accessible from the network
Discovery Timeline
- 2026-10-11 - CVE-2026-84252 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-84252
Vulnerability Analysis
The click5 CRM add-on registers a REST API endpoint intended to update plugin-specific configuration options. The endpoint handler omits capability checks, nonce validation, and scope restrictions on the option key being written. An unauthenticated attacker reaches the endpoint over the network and supplies an arbitrary WordPress option name and value. Because the handler calls the option update routine without validating the target key, any entry in the wp_options table can be overwritten.
Attackers typically abuse this pattern to flip two options: users_can_register is set to true, and default_role is set to administrator. The attacker then calls the standard WordPress registration flow and receives administrator privileges. From that account, arbitrary code execution follows through theme or plugin upload.
Root Cause
The root cause is a missing authorization check on a state-changing REST route, combined with the absence of an allowlist for option keys. The permission_callback for the route returns true unconditionally, and the handler passes user-supplied input directly to the option update function. See the WPScan Vulnerability Report for the vendor-reviewed details.
Attack Vector
Exploitation is remote, unauthenticated, and requires no user interaction. An attacker sends a crafted HTTP request to the vulnerable REST endpoint, targeting high-value WordPress options. After flipping registration and default role options, the attacker registers a new user through /wp-login.php?action=register and inherits administrator rights. No verified public exploit is listed in the enriched data, but the exploitation pattern is well understood for this vulnerability class.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-84252
Indicators of Compromise
- Unexpected changes to the users_can_register or default_role values in wp_options
- Creation of new administrator accounts outside normal provisioning windows
- POST or PUT requests to the click5 CRM add-on REST route from unauthenticated clients
- Modified siteurl or home option values redirecting traffic to attacker-controlled hosts
Detection Strategies
- Inspect web server access logs for unauthenticated requests to /wp-json/ routes exposed by the click5 CRM add-on
- Audit the wp_users and wp_usermeta tables for recently created accounts with the administrator role
- Compare current values of sensitive wp_options entries against a known-good baseline
Monitoring Recommendations
- Alert on any write to users_can_register, default_role, siteurl, home, or admin_email outside of change windows
- Monitor WordPress REST API traffic for anomalous unauthenticated POST volume
- Correlate new administrator account creation events with preceding REST API requests
How to Mitigate CVE-2026-84252
Immediate Actions Required
- Deactivate and remove the click5 CRM add-on to WPForms plugin until a patched release is available
- Review all WordPress administrator accounts and remove any that were not provisioned by authorized personnel
- Rotate credentials, API keys, and secrets stored in or accessible from the WordPress environment
- Restore users_can_register, default_role, and other sensitive options to their intended values
Patch Information
No fixed version is identified in the enriched CVE data. The vulnerability affects all versions through 1.0.3. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for a security release and apply it as soon as it becomes available.
Workarounds
- Block external access to the vulnerable REST route at the web application firewall or reverse proxy
- Restrict the WordPress REST API to authenticated users where business workflows allow
- Disable user registration by setting users_can_register to 0 and enforcing default_role as subscriber
- Remove the plugin directory from wp-content/plugins/ if deactivation through the admin UI is not feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
