CVE-2026-57641

In Real Estate 7 versions up to 3.5.9, there is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick a logged-in administrator into performing unintended actions in the application.

The risk involves the possibility of performing unauthorized operations in the admin panel, such as changing configuration or adding a new user, without the victim's knowledge.

Immediately update the Real Estate 7 plugin to a version newer than 3.5.9, where the vulnerability has been patched.