Unauthenticated REST Endpoint Allows Arbitrary WordPress Option Modification

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The click5 CRM add-on for WPForms contains a critical authorization bypass vulnerability (CWE-862) in its REST endpoint handlers. By failing to implement proper authentication and CSRF protections, the plugin allows unauthenticated attackers to modify arbitrary WordPress options without verification that the options belong to the plugin itself. This creates a direct path to site takeover: attackers can create new administrator accounts, reset credentials, modify site URLs, or inject malicious code—all without any valid user session. Any WordPress installation running the vulnerable click5 CRM add-on (versions through 1.0.3) is immediately at risk, particularly those exposed to the internet with REST API enabled.

Casky's 283 matched security skills help practitioners detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Privilege Escalation (TA0004) and Credential Access (TA0006) tactics. Practitioners would identify suspicious REST API calls to the plugin's endpoints lacking proper authorization headers, followed by WordPress option modifications (wp_options table changes) creating new administrator users. Claude's extended reasoning correlates these patterns: detecting unauthenticated requests to vulnerable endpoints, recognizing CSRF-free option updates, and flagging the creation of high-privilege accounts from external sources. Alert findings would highlight unauthorized wp_users insertions and wp_options alterations originating from non-admin API calls, enabling rapid identification and containment before full compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-84252.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-84252

Casky has 283 skills that investigate the attack patterns behind CVE-2026-84252. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn