{"vulnerability": "CVE-2026-84251", "sightings": [{"uuid": "f981998a-95e0-4513-acd1-99b82469b25e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84251", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117420896261179071", "content": "CVE-2026-84251 click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.\nhttps://www.cve.org/CVERecord?id=CVE-2026-84251https://wpscan.com/vulnerability/db54e1a5-51bc-431d-9a9e-9fa3ac96a817/#CVE_2026_84251#bot", "creation_timestamp": "2026-10-11T06:38:08.231070Z"}, {"uuid": "dd0eeaa4-9173-4906-8ba9-3cabfec77b9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84251", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxlygy5cxn2l", "content": "CVE-2026-84251 - click5 crm add-on to ninja forms\nThe click5 CRM add\u2011on for the Ninja Forms plugin in WordPress (up to version 1.0.1) does not verify who is making changes to its settings. Because of this, anyone on\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "creation_timestamp": "2026-10-11T12:20:04.571582Z"}]}