The click5 CRM add‑on to WPForms WordPress plugin, versions up to 1.0.3, contains a REST endpoint that updates plugin options without performing any authorization or CSRF validation. This exposes a flaw that lets an unauthenticated attacker write arbitrary configuration values, including creating a new administrator account. The resulting control over privileged options effectively hands the attacker full administrative authority over the site, allowing them to perform any action an administrator can.

Affected systems are WordPress installations running the click5 CRM add‑on to WPForms plugin through version 1.0.3. The vulnerability specifically impacts deployments where the REST endpoint is enabled and no additional authentication or CSRF protection is in place. The likely attack vector is the publicly accessible REST endpoint; this inference is drawn from the description of missing authorization and CSRF checks when updating options.

Because the flaw permits unauthenticated modification of options via a public REST endpoint, exploitation is straightforward. No credentials or special privileges are required; an attacker can issue crafted requests from any network that can reach the site’s REST API. The CVSS score of 9.8 indicates critical severity. The EPSS score is < 1%, suggesting a low but non-zero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Given the lack of authentication and the ability to create privileged accounts, the risk for site compromise is high.