CVE-2026-14547: Estatik Real Estate Plugin Spam Relay

CVE-2026-14547 Overview

CVE-2026-14547 affects the Estatik Real Estate Plugin for WordPress in versions prior to 4.3.3. The plugin fails to properly enforce its anti-spam check and does not restrict the recipient routing of its property request form. Unauthenticated attackers can send emails to arbitrary recipients with attacker-controlled subject, body, and Reply-To headers. The flaw effectively converts affected WordPress sites into an open mail relay for spam and phishing operations.

Critical Impact
Unauthenticated attackers can abuse vulnerable sites as a mail relay to distribute spam or phishing messages under the reputation of the hosting domain.

Affected Products

Estatik Real Estate Plugin for WordPress versions before 4.3.3

Discovery Timeline

2026-08-06 - CVE-2026-14547 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-14547

Vulnerability Analysis

The Estatik Real Estate Plugin exposes a property request form intended to send inquiries from prospective buyers to a property listing owner. The plugin implements an anti-spam check and an expected recipient routing model, but neither control is enforced server-side in a robust manner. An unauthenticated client can submit crafted requests that bypass the anti-spam validation and override the recipient address used by the plugin's mailer.

Because the form also accepts user-supplied values for the message subject, body, and Reply-To header, an attacker controls the full content and apparent origin of the outgoing email. The vulnerable site's mail server signs and dispatches the message, lending it the domain reputation of the WordPress host. This makes the site an effective open relay for phishing campaigns and bulk spam.

Root Cause

The root cause is Improper Input Validation combined with Broken Access Control on the form handler. The plugin trusts client-supplied recipient routing parameters and fails to bind the destination address to a server-side property record. The anti-spam check is either evaluated incorrectly or applied in a way that attackers can circumvent by manipulating request parameters.

Attack Vector

The attack requires no authentication and is exploitable over the network. An attacker submits crafted HTTP requests to the plugin's property request form endpoint, supplying arbitrary values for the recipient, subject, body, and Reply-To fields. The plugin then dispatches the email through the site's configured mail transport. Refer to the WPScan Vulnerability Detail for the technical writeup.

Detection Methods for CVE-2026-14547

Indicators of Compromise

Outbound SMTP traffic from the WordPress host containing messages addressed to recipients unrelated to the site's normal correspondence.
Unusual spikes in POST requests to Estatik property request form endpoints from a small set of source IPs.
Mail server logs showing From addresses on the site's domain paired with unrelated Reply-To addresses.
Abuse complaints, blocklist entries, or bounce messages referencing the WordPress domain.

Detection Strategies

Inspect WordPress access logs for repeated submissions to the plugin's AJAX or REST endpoints handling property inquiries.
Correlate web request bodies with subsequent outbound mail events to detect attacker-controlled subject or body content.
Alert on outbound emails where the Reply-To domain differs from the site domain and the recipient is external.

Monitoring Recommendations

Rate-limit and log all outbound mail from the WordPress host at the mail transport layer.
Monitor domain reputation on major blocklists such as Spamhaus and SURBL.
Track WordPress plugin inventory and versions to identify hosts still running Estatik below 4.3.3.

How to Mitigate CVE-2026-14547

Immediate Actions Required

Update the Estatik Real Estate Plugin to version 4.3.3 or later on all WordPress sites.
Review mail server logs for evidence of prior abuse and notify recipients if phishing was distributed.
Rotate any credentials or API keys exposed through outbound mail that referenced the site domain.

Patch Information

The vendor addressed the vulnerability in Estatik Real Estate Plugin version 4.3.3. Administrators should apply the update through the WordPress plugin manager. See the WPScan Vulnerability Detail for advisory information.

Workarounds

Disable the Estatik Real Estate Plugin until the patched version can be installed.
Restrict access to the property request form endpoints using a web application firewall rule that blocks unauthenticated submissions containing external recipient parameters.
Configure the site's mail transport to reject outbound messages whose Reply-To header does not match an allowlisted domain.

bash

# Example WP-CLI upgrade command
wp plugin update estatik --version=4.3.3