Estatik Real Estate Plugin CVE-2026-16262

Exploitation requires that the Estatik Real Estate Plugin's OAuth social login feature is enabled and configured on the target WordPress site, which is a non-default configuration requiring active setup by the site administrator. The victim must be induced to click a crafted link or visit a malicious page that triggers the OAuth callback flow in their browser - this is the mandatory user interaction that the provided CVSS vector's UI:N incorrectly omits. The attacker must control a valid account on the social OAuth provider (e.g., Google, Facebook) used by the target site. Exploitation is limited to sites where social login is actively deployed; standard username/password login is unaffected. No authentication is required from the attacker's side on the WordPress site itself.

There is a notable conflict between the provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and the vulnerability description. The vector's UI:N contradicts CSRF mechanics, which inherently require victim interaction (UI:R). The C:N/I:N/A:H impact metrics are also inconsistent with a login CSRF - the actual impact is confidentiality (attacker reads victim data) and integrity (victim's actions are misdirected), not availability. This CVSS vector appears incorrectly assigned and should not be used for prioritization without vendor verification. EPSS at 0.10% (1st percentile) indicates extremely low observed exploitation probability, and CISA KEV status is not confirmed. However, a public POC exists via WPScan, SSVC marks the attack as automatable, and the OAuth CSRF class is well-understood and easy to weaponize at scale via phishing. Real-world risk is moderate for WordPress real estate sites: the confidentiality/integrity harm to individual victims is meaningful (personal data exposure, identity confusion), but mass exploitation is constrained by the niche deployment footprint and the UI:R requirement.

An attacker registers a social media (e.g., Google or Facebook) account under their control and initiates an OAuth login on a target WordPress site running the vulnerable Estatik plugin. The attacker captures the OAuth callback URL for their own account, then crafts a phishing email or malicious page that causes a victim - such as a prospective home buyer - to click a link that completes the OAuth handshake, logging the victim into the attacker's account. The victim then submits their personal details, saved property preferences, and contact information, all of which are visible to the attacker through the attacker-controlled social account.