CVE-2026-18044

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.

Score
CVSS 3.1 3.7 Low
Status
Deferred - contact@wpscan.com
Published
2026-08-12
Last modified
2026-08-12
Weaknesses
CWE-345

Affected products

References

 
 
© AVABIS GmbH privacypolicy about