EUVD-2026-57177
GHSA-xjx9-mjr5-hr38
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible form requires no auth or interaction, but AC:H because custom routing configuration is a non-default prerequisite; impact is integrity-only via email relay.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
AnalysisAI
Email injection in the Estatik Real Estate Plugin for WordPress (versions before 4.3.4) allows unauthenticated remote users to send emails to arbitrary recipients with fully attacker-controlled subject, body, and Reply-To headers by abusing the plugin's unvalidated property request form recipient list. The site's own mail infrastructure is effectively weaponized as an open relay, enabling phishing and spam distribution from a trusted sending domain. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Estatik Real Estate Plugin's property request form to be explicitly configured by a site administrator to route submissions to a custom recipient address - this is a non-default configuration state, which is reflected in the AC:H CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.7 Low score is assigned with AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Estatik Real Estate Plugin to version 4.3.4 or later, which introduces validation of the recipient list prior to use in email dispatch - this is the vendor-released patch per the WPScan advisory at https://wpscan.com/vulnerability/87623f1e-c0fa-4563-af13-68e51ba2d7a9/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Estatik Real Estate Plugin
View allLogin CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack
Open email relay in the Estatik Real Estate Plugin for WordPress (before 4.3.3) allows unauthenticated remote attackers
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today