WordPress Click5 CRM Add-On Arbitrary Option Update Vulnerability

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 lacks authorisation and CSRF checks when updating options via a REST endpoint.

It also does not ensure that the option to be updated belongs to the plugin.

• Affected versions: through 1.0.3
• Impact: unauthenticated attackers can change arbitrary blog options, create a new administrator account, and take over the site.