A lack of authorization and CSRF protections on the click5 CRM add‑on to Contact Form 7 WordPress plugin allows an attacker to send requests to an exposed REST endpoint and modify any option value stored by WordPress. By changing the option that defines user roles, an attacker can create or elevate a user to the Administrator level, giving full control over the site and its data.

WordPress users who have installed the click5 CRM add‑on to Contact Form 7 plugin version 1.0.4 or earlier. The vulnerability is present in all WordPress installations that include this plugin without a newer, patched version.

The vulnerability operates over HTTP and does not require any authenticated session. EPSS indicates a very low probability of exploitation (<1%), yet the presence of a public endpoint means that, if an exploit is developed, privilege escalation would be possible. The CVSS score of 9.8 signifies a critical severity, and the potential to grant site‑wide administrative rights classifies the issue as high‑risk for any affected WordPress site. The vulnerability is not listed in the CISA KEV catalog.