The click5 CRM add‑on for Gravity Forms (WordPress) allows unauthenticated users to call a REST endpoint that updates plugin options without performing authorization or CSRF checks. Because the endpoint does not validate that the option belongs to the add‑on, an attacker can alter site‑wide settings. This flaw enables an attacker to create a new administrator account and effectively take control of the WordPress site, compromising confidentiality, integrity, and availability.

Any website running the click5 CRM add‑on for Gravity Forms WordPress plugin version 1.0.3 or earlier is vulnerable. The affected part is the REST API route exposed by the add‑on, which accepts option updates. Users who rely on this add‑on should check for updates beyond version 1.0.3 or remove the plugin if it is no longer needed.

The vulnerability was published with an EPSS score of 0.00106, indicating a very low but non‑zero exploitation probability. The CVSS score of 9.8 classifies the flaw as critical. It is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating that there are no confirmed public exploits yet. However, the lack of authentication checks means any user with network access to the site can trigger the malicious payload. Given the potential to create privileged accounts and the absence of protective controls, the risk is considered high. The vulnerability could be exploited by sending crafted REST requests from any source that can reach the site.