CVE-2026-18044: low-severity vulnerability in Estatik Real Estate Plugin
Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 3.7epss 0.1%
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Estatik Real Estate Pluginpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/87623f1e-c0fa-4563-af13-68e51ba2d7a9/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Estatik Real Estate Plugin
In the same product, most dangerous first.
CVE-2023-6049CRITICALEstatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object InjectionEPSS 0.9%CVE-2023-6048MEDIUMEstatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option UpdateEPSS 0.6%CVE-2023-6050MEDIUMEstatik Real Estate Plugin < 4.1.1 - Reflected XSSEPSS 0.4%CVE-2026-14547MEDIUMEstatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request FormEPSS 0.3%CVE-2026-76790HIGHEstatik < 4.3.5 - Reflected XSS via get_listings hash ParameterEPSS 0.3%CVE-2026-16262HIGHEstatik < 4.3.3 - Login CSRFEPSS 0.2%