EUVD-2026-53721
GHSA-jq55-hqc7-pmch
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible public form requires no authentication or complexity; impact is integrity-only via email relay with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.
AnalysisAI
Open email relay in the Estatik Real Estate Plugin for WordPress (before 4.3.3) allows unauthenticated remote attackers to send arbitrary emails through any affected WordPress site by submitting crafted property inquiry form requests with controlled recipient address, subject, body, and Reply-To header. The plugin's anti-spam check is trivially bypassed and provides no constraint on recipient routing, effectively turning victim sites into spam or phishing infrastructure. A publicly available exploit exists per WPScan; EPSS sits at 0.14% (3rd percentile) and CISA KEV does not list active exploitation, suggesting limited but plausible abuse given SSVC confirms the attack is automatable.
Technical ContextAI
The vulnerability resides in the property inquiry (contact) form shipped by the Estatik Real Estate Plugin, a WordPress real estate listing plugin. The form is intended to route prospective buyer messages to property owners or site administrators. Under CWE-287 (Improper Authentication), the plugin fails to properly validate or enforce its anti-spam gate - the mechanism that should authenticate or verify form submissions before acting on them - allowing arbitrary control over the outgoing email's To, Subject, Body, and Reply-To fields. This is a classic open mail relay pattern at the application layer: the WordPress site's configured SMTP or PHP mail() infrastructure is weaponized to deliver attacker-composed email to any address. The CPE string (cpe:2.3:a:unknown:estatik_real_estate_plugin:*:*:*:*:*:*:*:*) covers all versions below 4.3.3. No cryptographic or memory-safety primitives are involved; the root cause is pure input validation and access control failure on a contact form endpoint.
RemediationAI
The primary remediation is to upgrade the Estatik Real Estate Plugin to version 4.3.3 or later, which is confirmed as the vendor-released patch per WPScan and EUVD data. Site administrators should update immediately via the WordPress plugin dashboard or by downloading the fixed release from the WordPress.org plugin repository. If an immediate upgrade is not feasible, the most targeted workaround is to disable or remove the Estatik property inquiry form entirely, either by deactivating the plugin or using the plugin's form settings to disable contact functionality - this eliminates the attack surface entirely but also removes legitimate lead-generation capability for the site. Blocking unauthenticated POST requests to the form's submission endpoint at the WAF or server layer is a partial control but requires accurate endpoint identification and may interfere with legitimate use. Adding a server-side CAPTCHA at the infrastructure level (e.g., via a separate WordPress security plugin) could raise the bar for automated abuse but does not fix the underlying recipient-routing flaw. Advisory references: WPScan (https://wpscan.com/vulnerability/5c208be8-57db-4f74-8030-398c1eece293/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-14547).
More in Estatik Real Estate Plugin
View allLogin CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack
Email injection in the Estatik Real Estate Plugin for WordPress (versions before 4.3.4) allows unauthenticated remote us
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today