CVE-2026-16262
Estatik < 4.3.3 - Login CSRF
- State
- Published
- Severity
- 7.5 High
- Published
- Aug 7, 2026
- Updated
- Aug 7, 2026
- Reserved
- Jul 20, 2026
Description
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
Estatik Real Estate PluginUnknown |
|
References
- https://wpscan.com/vulnerability/5930f82f-8dc8-41b1-8b78-c71883e7ef22/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.