Estatik Real Estate Plugin
Monthly
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
Email injection in the Estatik Real Estate Plugin for WordPress (versions before 4.3.4) allows unauthenticated remote users to send emails to arbitrary recipients with fully attacker-controlled subject, body, and Reply-To headers by abusing the plugin's unvalidated property request form recipient list. The site's own mail infrastructure is effectively weaponized as an open relay, enabling phishing and spam distribution from a trusted sending domain. A publicly available proof-of-concept is referenced in the WPScan advisory; active exploitation has not been confirmed by CISA KEV, though the low skill barrier introduced by the PoC elevates practical risk above what the CVSS 3.7 base score alone suggests.
Open email relay in the Estatik Real Estate Plugin for WordPress (before 4.3.3) allows unauthenticated remote attackers to send arbitrary emails through any affected WordPress site by submitting crafted property inquiry form requests with controlled recipient address, subject, body, and Reply-To header. The plugin's anti-spam check is trivially bypassed and provides no constraint on recipient routing, effectively turning victim sites into spam or phishing infrastructure. A publicly available exploit exists per WPScan; EPSS sits at 0.14% (3rd percentile) and CISA KEV does not list active exploitation, suggesting limited but plausible abuse given SSVC confirms the attack is automatable.
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
Email injection in the Estatik Real Estate Plugin for WordPress (versions before 4.3.4) allows unauthenticated remote users to send emails to arbitrary recipients with fully attacker-controlled subject, body, and Reply-To headers by abusing the plugin's unvalidated property request form recipient list. The site's own mail infrastructure is effectively weaponized as an open relay, enabling phishing and spam distribution from a trusted sending domain. A publicly available proof-of-concept is referenced in the WPScan advisory; active exploitation has not been confirmed by CISA KEV, though the low skill barrier introduced by the PoC elevates practical risk above what the CVSS 3.7 base score alone suggests.
Open email relay in the Estatik Real Estate Plugin for WordPress (before 4.3.3) allows unauthenticated remote attackers to send arbitrary emails through any affected WordPress site by submitting crafted property inquiry form requests with controlled recipient address, subject, body, and Reply-To header. The plugin's anti-spam check is trivially bypassed and provides no constraint on recipient routing, effectively turning victim sites into spam or phishing infrastructure. A publicly available exploit exists per WPScan; EPSS sits at 0.14% (3rd percentile) and CISA KEV does not list active exploitation, suggesting limited but plausible abuse given SSVC confirms the attack is automatable.