The CRM add-on vulnerability hitting four form plugins

Click5's CRM add-ons for Contact Form 7, WPForms, Gravity Forms, and Ninja Forms each carry a critical, unauthenticated takeover bug disclosed October 11, 2026, and none of the four has a patched version yet.

These aren't obscure plugins. They're the small bridge add-ons that take a form submission and push it into a CRM, which is exactly the kind of connector a lot of service businesses wire into their lead flow without thinking much about it again. All four add-ons were assigned their own CVE on the same day, all rated 9.8 critical, all from the same vendor, all with the same root cause.

What the CRM add-on vulnerability actually does

Per the published advisories, each add-on exposes a REST endpoint that updates WordPress options with no authorization check and no CSRF check, and it never confirms that the option being changed actually belongs to the add-on. That combination means an unauthenticated visitor can call the endpoint directly and change site-wide options, including the ones WordPress uses to register a new administrator, with no login and no other misconfiguration needed beyond having the add-on installed and active. The four CVEs are CVE-2026-84254 (Contact Form 7, through 1.0.4), CVE-2026-84252 (WPForms, through 1.0.3), CVE-2026-84253 (Gravity Forms, through 1.0.3), and CVE-2026-84251 (Ninja Forms, through 1.0.1), and as of this writing none lists a fixed version.

Why this matters for lead capture, not just security

Your contact form is usually the first step in an automation, not the end of one. If a quote request feeds a CRM, triggers a Zap, or kicks off an n8n workflow, this add-on sits upstream of all of it. An attacker who takes the site doesn't just deface a page. They sit at the exact point where new leads enter the business, which means they can intercept submissions, quietly redirect form targets, or knock the whole pipeline offline while everything downstream keeps running as if nothing changed.

What to do if you run any of these forms

1. 1

   Find the add-on

   In wp-admin, go to Plugins and search for click5, or check your form plugin's settings for a CRM sync panel. If it's active, you're exposed with no extra misconfiguration needed.

2. 2

   Deactivate before you wait on a patch

   None of the four CVEs lists a fixed version yet. Deactivating the add-on closes the open endpoint right away. Your forms keep collecting submissions, they just stop pushing them into the CRM until a fix ships.

3. 3

   Check your admin users now

   Go to Users in wp-admin and look for any administrator account you don't recognize, especially ones added in the last few days. This bug's whole point is creating exactly that.

4. 4

   Re-test after the update

   Once click5 ships a patched version, update, then manually submit a test lead through each form and confirm it still lands in your CRM before you trust the sync again.

The pattern worth remembering

The form plugin itself usually gets the security attention. The small connector that bridges it to your CRM usually doesn't, and it's running with the same access to your site either way. Any time you add a plugin whose only job is to move data from one tool to another, it's worth a quick look at who maintains it and how often it's updated, the same way you'd vet a new step in an automation before you let it touch customer data.

If you want a second set of eyes on how your forms feed into your CRM or your automation stack, send over what you're running and I'll take a look.