CVE-2026-14547 in Estatik Real Estate Plugin
Summary
by MITRE • 08/06/2026
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The Estatik Real Estate Plugin for WordPress presents a critical security vulnerability that enables unauthorized email relay functionality through its property request form. This flaw exists in versions prior to 4.3.3 and allows malicious actors to exploit the plugin's anti-spam mechanisms entirely bypassing intended security controls. The vulnerability stems from inadequate input validation and access control enforcement within the plugin's contact form processing logic, creating an attack vector that transforms legitimate website infrastructure into a tool for unwanted email transmission.
The technical implementation of this vulnerability involves the plugin failing to properly validate or restrict the recipient email addresses specified in the property request form submissions. Attackers can manipulate form parameters to direct emails toward any arbitrary recipient address while simultaneously controlling subject lines, message content, and Reply-To headers. This lack of proper sanitization and validation creates a mail relay scenario where unauthenticated users can leverage the WordPress site's mail server capabilities for mass email distribution without restriction or oversight.
The operational impact of this vulnerability extends beyond simple spam generation to encompass more serious security implications including phishing campaigns and social engineering attacks. The ability to send emails with custom Reply-To addresses and subject lines provides attackers with sophisticated means to craft convincing fraudulent communications that appear to originate from legitimate real estate websites. This capability transforms the compromised website into an effective vector for credential harvesting, malware distribution, and reputation damage against the affected organization.
This vulnerability aligns with CWE-829, which describes the inclusion of a security-sensitive resource in a way that allows unauthorized access or modification, and maps to ATT&CK technique T1192, specifically targeting the use of compromised systems for sending spam email. The flaw represents a failure in input validation and access control enforcement, where proper sanitization of user-supplied data should have been implemented to prevent arbitrary email routing. Security best practices dictate that all external communications should be properly authenticated and authorized, with clear boundaries on recipient addresses and message content.
Mitigation strategies for this vulnerability require immediate plugin updates to version 4.3.3 or later, which contain the necessary security patches to enforce proper anti-spam controls. Organizations should also implement additional defensive measures including monitoring outbound email traffic for unusual patterns, implementing rate limiting on contact form submissions, and conducting thorough security audits of all WordPress plugins. Network-level restrictions such as email filtering rules and DNS-based authentication mechanisms can provide additional layers of protection against abuse while administrators should review and tighten access controls around plugin configuration settings to prevent unauthorized modifications that could reintroduce similar vulnerabilities.