CVE-2026-18044 in Estatik Real Estate Plugin
Summary
by MITRE • 08/12/2026
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The Estatik Real Estate WordPress plugin vulnerability represents a critical email injection flaw that stems from inadequate input validation within its property request form functionality. This vulnerability affects versions prior to 4.3.4 and creates a scenario where malicious actors can exploit the plugin's email handling mechanism to send unsolicited messages to arbitrary email addresses. The core technical issue lies in the plugin's failure to properly sanitize or validate the recipient list that is later used in the email composition process, allowing attackers to manipulate the destination addresses through the web form interface.
The operational impact of this vulnerability extends beyond simple spamming capabilities as it enables sophisticated phishing attacks and social engineering campaigns. Attackers can craft malicious emails with customized subject lines and body content, potentially including links to malicious websites or credentials harvesting pages. The inclusion of arbitrary Reply-To fields further compounds the threat by allowing attackers to direct responses to their own email addresses, making it difficult for administrators to trace the source of malicious communications. This vulnerability particularly affects websites where the plugin is configured to route form submissions to custom email addresses rather than default system recipients.
Security professionals should note this vulnerability aligns with CWE-94, which covers "Improper Control of Generation of Code," and more specifically relates to CWE-74, "Improper Neutralization of Special Elements in Output Used by a Downstream Component." The attack vector follows patterns consistent with SMTP injection techniques documented in the MITRE ATT&CK framework under T1192, "Spearphishing Attachment," and T1566, "Phishing," where attackers leverage web application vulnerabilities to facilitate malicious email campaigns. Organizations using this plugin are particularly vulnerable as the flaw requires no authentication to exploit, making it accessible to anyone who can access the property request form.
Mitigation strategies should prioritize immediate patching to version 4.3.4 or later, which addresses the input validation deficiency through proper sanitization of recipient lists and email headers. Administrators should also implement additional defensive measures including rate limiting on form submissions to prevent automated abuse, monitoring email logs for unusual sending patterns, and configuring email server restrictions to limit outbound messaging capabilities. Network-level controls such as email filtering rules and domain-based message authentication can provide additional layers of protection against exploitation attempts. The vulnerability demonstrates the critical importance of input validation in web applications and serves as a reminder that even seemingly benign form functionality can become a vector for significant security breaches when proper sanitization measures are not implemented.