The click5 CRM add‑on to Ninja Forms plugin for WordPress up to version 1.0.1 contains a REST API endpoint that allows updating options without any authorization or CSRF protection. Because the endpoint does not confirm that the option key belongs to the add‑on, an unauthenticated attacker can modify any WordPress setting, including adding a new administrator account. This flaw enables full site takeover and corresponds to Missing Authorization (CWE‑862). Based on the description, it is inferred that the attacker only needs to send unauthenticated HTTP requests to the vulnerable REST endpoint to exploit the flaw.

WordPress sites that have the click5 CRM add‑on to Ninja Forms plugin installed at version 1.0.1 or earlier are affected. No specific WordPress core or PHP version is indicated, so any site running the vulnerable plugin is at risk.

The CVSS base score of 9.8 signals a critical severity, and the EPSS score of less than 1% suggests that exploitation is currently rare but still possible when the REST endpoint is reachable. Since no authentication or CSRF checks exist, the exploitation requires only basic HTTP requests to the plugin’s endpoint, making it trivial for an attacker with network access to the site. Successful exploitation results in a complete compromise of the WordPress installation, including the ability to modify site content, install malware, or exfiltrate data. The lack of explicit authentication checks implies, based on the description, that the attack vector is inferred to be an unauthenticated HTTP request to the REST endpoint.