Security Alert Summary
The Estatik Real Estate Plugin for WordPress (versions before 4.3.4) does not validate the recipient list used when sending messages from its property request form. This allows unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To headers on sites where the form is configured to route to a custom address.
CVE Details
- CVE ID: CVE-2026-18044
- Affected component: Estatik Real Estate Plugin (WordPress plugin)
- Affected versions: versions before 4.3.4 (reported as < 4.3.4)
- Published: August 12, 2026 at 12:17:47 PM UTC
- Last modified: August 12, 2026 at 12:17:47 PM UTC
- CVSS v3.1 base score: 3.7 (LOW)
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction: No authentication required; privileges required: None; user interaction: None. Attack complexity: High. Attack vector: Network. Scope: Unchanged.
- Primary impact: Confidentiality: None; Integrity: Low (ability to send arbitrary message content); Availability: None
- Weakness (CWE): CWE-345
Technical Details
The plugin fails to validate the recipient list that is later used to address messages sent by its property request form. Specifically, when the form is configured to route requests to a custom address, the recipient list accepted by the form is not enforced or verified before the message is sent. As a result, unauthenticated users can cause the plugin to send emails to arbitrary recipients and specify arbitrary subject, body and Reply-To values.
No specific functions or REST API endpoints are named in the available information. The root cause identified is a missing validation step for the recipient list used when composing and sending messages from the property request form.
The impact described in the report is limited to the ability to send crafted email messages via the plugin’s form processing. The issue does not, based on the provided data, indicate direct ability to modify site content, escalate privileges, or affect availability of the WordPress installation itself.
How This Could Impact Your Website
Consider a typical site with a site owner, internal staff (agents or editors), and external contractors or contributors who may interact with listings or lead forms. If the property request form is configured to route to a custom address and the site uses a vulnerable plugin version, an unauthenticated attacker could submit the form with arbitrary recipient and message fields.
- Internal staff email addresses or third-party contacts could receive unsolicited messages sent through your site, potentially exposing contact lists or routing information.
- Attackers could send messages that appear to originate from your site with arbitrary Reply-To headers and subjects, increasing the risk of targeted phishing or social engineering against staff or partners.
- While the vulnerability focuses on email sending, abuse of site-sent email can harm trust, lead to reputation issues, or result in outbound email being flagged by spam filters.
If you9re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (apply vendor-supplied updates).
- Review and reduce unnecessary user roles, especially contributors or any roles that can manage forms or contact routing.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and outgoing email logs for unusual behavior or unexpected recipients.
If you9d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
