Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-84251: click5 CRM add‑on for Ninja Forms lets anyone create admin
CVE-2026-84251 · published 5 days ago
Summary
The click5 CRM add‑on for the Ninja Forms plugin in WordPress (up to version 1.0.1) does not verify who is making changes to its settings. Because of this, anyone on the internet can alter site options and add a new administrator account, giving them full control of the site. Update the add‑on to a newer version that includes proper checks, or remove it if it’s not needed, and keep administrative access limited to trusted users.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | click5 crm add-on to ninja forms | <= 1.0.1 |
Original advisory text
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-862Missing Authorization
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published11 Oct 2026
Updated15 Oct 2026
First seen11 Oct 2026
Track software like this
Free during beta