Unauthenticated REST Endpoint Allows Arbitrary WordPress Option Modification

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The click5 CRM add-on for Contact Form 7 contains a critical authorization bypass vulnerability in its REST API endpoint that handles option updates. The flaw stems from missing authorization checks (CWE-862) and CSRF protections, combined with insufficient validation of which options can be modified. This allows completely unauthenticated attackers to modify arbitrary WordPress blog options without requiring any credentials or valid session tokens. Since WordPress options control fundamental site settings, attackers can exploit this to create new administrator accounts, modify plugin configurations, or alter site URLs—effectively gaining complete control over affected WordPress installations. Any organization using Contact Form 7 with the click5 CRM add-on through version 1.0.4 is at immediate risk, particularly those managing customer interactions or sensitive data through their WordPress sites.

Casky's 283 matching skills detect the attack patterns behind this vulnerability across two critical MITRE ATT&CK tactics: TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious REST API calls to the click5 endpoint with missing authorization headers, followed by WordPress option modifications that don't align with normal administrative behavior. The platform's extended reasoning capabilities flag the chain: unauthenticated REST requests → arbitrary wp_options table modifications → administrator user creation → lateral movement opportunities. Security teams would see findings highlighting requests from untrusted sources modifying sensitive options like admin_email or siteurl, combined with detection of newly created high-privilege accounts appearing shortly after suspicious API activity. This multi-step pattern recognition helps practitioners distinguish between legitimate administrative changes and exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-84254.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-84254

Casky has 283 skills that investigate the attack patterns behind CVE-2026-84254. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn