CVE-2026-18044
LowCVSS 3.7Summary
The Estatik Real Estate Plugin for WordPress before version 4.3.4 does not validate the recipient list used for messages sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body, and Reply-To on sites where the form is configured to route to a custom address.
Risk Assessment
An attacker could exploit this vulnerability to send spam or phishing emails from the server, potentially harming the organization's reputation and exposing users to scams.
Recommendation
It is recommended to update the plugin to version 4.3.4 or later immediately and review the form configuration for unauthorized use.
Original NVD description (English source)
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.