CVE-2026-18044
Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch
- State
- Published
- Severity
- 3.7 Low
- Published
- Aug 12, 2026
- Updated
- Aug 12, 2026
- Reserved
- Jul 28, 2026
Description
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N | WPScan |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
Estatik Real Estate PluginUnknown |
|
References
- https://wpscan.com/vulnerability/87623f1e-c0fa-4563-af13-68e51ba2d7a9/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.