EUVD-2026-54390
GHSA-jqr2-6x6h-fvmp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CSRF inherently requires victim interaction (UI:R); attacker reads victim data (C:H) and misdirects victim actions (I:H); no availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
AnalysisAI
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
Technical ContextAI
The vulnerability stems from CWE-352 (Cross-Site Request Forgery) applied to an OAuth 2.0 social login flow. Secure OAuth implementations must tie the authorization code exchange to the browser session that initiated the login (typically via a 'state' parameter bound to a session cookie). The Estatik Real Estate Plugin (CPE: cpe:2.3:a:unknown:estatik_real_estate_plugin:*:*:*:*:*:wordpress:*:*) fails to enforce this binding, meaning an attacker can initiate an OAuth flow with their own credentials, generate a callback URL, and then trick a victim's browser into completing the handshake - resulting in the victim being authenticated as the attacker's account. This is a variant of login CSRF distinct from classic form-based CSRF, and is particularly insidious because the victim appears logged in normally while all their actions enrich the attacker's account.
RemediationAI
Update the Estatik Real Estate Plugin to version 4.3.3 or later, which is confirmed available from the vendor per the WPScan advisory at https://wpscan.com/vulnerability/5930f82f-8dc8-41b1-8b78-c71883e7ef22/. If immediate patching is not feasible, disable the OAuth social login feature within the plugin's settings - this eliminates the vulnerable code path entirely, with the trade-off that social login is unavailable to users. As an additional layer, consider blocking or rate-limiting OAuth callback endpoints at the WAF level to reduce automated exploitation attempts. Site administrators should also audit recent user account activity for any sessions where a user's activity appears under a mismatched account, as this may indicate exploitation has already occurred.
More in Estatik Real Estate Plugin
View allOpen email relay in the Estatik Real Estate Plugin for WordPress (before 4.3.3) allows unauthenticated remote attackers
Email injection in the Estatik Real Estate Plugin for WordPress (versions before 4.3.4) allows unauthenticated remote us
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today