CVE-2026-84254 Overview
CVE-2026-84254 is a critical missing authorization vulnerability in the click5 CRM add-on for the Contact Form 7 WordPress plugin through version 1.0.4. The plugin exposes a REST endpoint that updates WordPress options without performing capability checks, Cross-Site Request Forgery (CSRF) validation, or scope restrictions on which options can be modified. Unauthenticated attackers can change arbitrary blog options, register a new administrator account, and take full control of the affected site. The flaw is tracked under CWE-862: Missing Authorization.
Critical Impact
Unauthenticated remote attackers can modify arbitrary WordPress options and promote themselves to administrator, leading to complete site takeover.
Affected Products
- click5 CRM add-on for Contact Form 7 WordPress plugin, versions up to and including 1.0.4
- WordPress sites running the vulnerable plugin alongside Contact Form 7
- Any multisite deployment where the vulnerable plugin is network-activated
Discovery Timeline
- 2026-10-11 - CVE-2026-84254 published to the National Vulnerability Database
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-84254
Vulnerability Analysis
The click5 CRM add-on registers a REST API route intended to let administrators update plugin-specific settings stored in the WordPress wp_options table. The route handler does not verify the caller's identity or capabilities, does not validate a CSRF nonce, and does not restrict the option name to those belonging to the plugin. This combination allows any unauthenticated client that can reach the WordPress REST endpoint to overwrite sensitive options.
Attackers can flip users_can_register to 1 and set default_role to administrator. A subsequent request to /wp-login.php?action=register then creates an administrator account under attacker control. Alternative exploitation paths include overwriting siteurl and home for traffic redirection or injecting malicious scripts through options rendered in the admin dashboard.
Root Cause
The root cause is a missing permission_callback on the plugin's register_rest_route() call combined with absent nonce verification and absent allowlisting of the target option name. The handler trusts request parameters and passes them directly to update_option(), violating least privilege and option-scope boundaries expected of WordPress plugins.
Attack Vector
Exploitation requires only network reachability to the WordPress REST API. The attacker sends a crafted POST request to the plugin's REST route, specifying the option name and value to overwrite. No authentication, user interaction, or elevated privileges are required. Public details are limited to the WPScan Vulnerability Report.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-84254
Indicators of Compromise
- Unexpected changes to the users_can_register or default_role options in wp_options
- Creation of new administrator accounts with no corresponding admin activity in access logs
- POST requests to /wp-json/ routes registered by the click5 CRM add-on from unauthenticated sources
- Modifications to siteurl or home values that do not match the known site URL
Detection Strategies
- Monitor WordPress audit logs for update_option events affecting authentication-related options
- Alert on administrator account creation events immediately followed by first-time logins from new IP addresses
- Inspect web server access logs for anonymous POST requests targeting the plugin's REST endpoints
Monitoring Recommendations
- Enable file integrity monitoring on wp-config.php and the plugin directory
- Forward WordPress and web server logs to a centralized SIEM for correlation across request, option change, and user creation events
- Track wp_users and wp_usermeta changes to identify unauthorized role escalations
How to Mitigate CVE-2026-84254
Immediate Actions Required
- Deactivate and remove the click5 CRM add-on for Contact Form 7 until a patched version is released
- Audit wp_users and wp_usermeta for unknown administrator accounts and remove any unauthorized entries
- Reset passwords for all legitimate administrator accounts and rotate any API keys stored in WordPress options
- Verify the integrity of siteurl, home, users_can_register, and default_role option values
Patch Information
No patched version is referenced in the available advisory. All versions through 1.0.4 are vulnerable. Monitor the WPScan Vulnerability Report and the WordPress plugin repository for an updated release before reinstalling.
Workarounds
- Block external access to the plugin's REST routes at the web application firewall or reverse proxy layer
- Set users_can_register to 0 and enforce default_role as subscriber via wp-config.php constants or a mu-plugin
- Restrict access to /wp-json/ endpoints to authenticated sessions where business requirements allow
# Temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate click5-crm-cf7
wp plugin delete click5-crm-cf7
# Harden registration-related options
wp option update users_can_register 0
wp option update default_role subscriber
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
