5.3
Medium
CVE-2026-14547 The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict…
Description
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Estatik Real Estate Plugin 4.3 | earliest → < 4.3.3 | 4.3.3 |
Other CVEs of Estatik Real Estate Plugin
The 7 CVEs of Estatik Real Estate Plugin →
CVE-2026-76790
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from…
7.1
High
CVE-2026-18044
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later…
3.7
Low
CVE-2026-16262
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating…
7.5
High
CVE-2023-6050
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and…
6.1
Medium