CVE-2026-18044: Estatik Real Estate Plugin Email Forging

CVE-2026-18044 Overview

CVE-2026-18044 affects the Estatik Real Estate Plugin for WordPress in versions before 4.3.4. The plugin fails to validate the recipient list used by its property request form. Unauthenticated attackers can send emails to arbitrary recipients through the form when it is configured to route to a custom address. Attackers control the subject, body, and Reply-To header of the outbound message.

The flaw enables abuse of the affected WordPress site as an open email relay. This category of weakness is tracked as insufficient verification of data authenticity [CWE-345].

Critical Impact
Unauthenticated attackers can send emails with arbitrary recipients, subjects, bodies, and Reply-To headers from the affected WordPress domain, enabling phishing and spam distribution using the site's mail reputation.

Affected Products

Estatik Real Estate Plugin for WordPress, all versions before 4.3.4
WordPress sites where the property request form is configured to route to a custom email address
Fixed in Estatik Real Estate Plugin version 4.3.4

Discovery Timeline

2026-08-12 - CVE-2026-18044 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18044

Vulnerability Analysis

The Estatik Real Estate Plugin exposes a property request form intended to route inquiries to a property agent or site administrator. When the form is configured with a custom recipient address, the plugin trusts recipient data provided through the request without revalidating it against a server-side allowlist.

Because the form processes unauthenticated submissions, any anonymous visitor can invoke the mail-sending routine. The attacker supplies an arbitrary destination address, subject line, message body, and Reply-To header. The plugin then delivers the message using the WordPress site's configured mail transport.

The practical result is an open relay bound to the reputation of the WordPress domain. Attackers can send phishing emails that pass SPF, DKIM, and DMARC checks aligned to the victim site. The impact is limited to integrity of outbound email content; the vulnerability does not disclose data or degrade availability of the host.

Root Cause

The root cause is missing verification of data authenticity [CWE-345] on the recipient parameter used by the property request form handler. The plugin does not confirm that the recipient value submitted with the request matches the trusted address stored in its configuration.

Attack Vector

The attack is delivered over the network against the public property request form endpoint. No authentication or user interaction is required. Successful exploitation depends on the site operator having configured the form to route to a custom address, which conditions the vulnerable code path.

The vulnerability mechanism is described in the WPScan Vulnerability Report. No public proof-of-concept exploit code is verified for CVE-2026-18044.

Detection Methods for CVE-2026-18044

Indicators of Compromise

Outbound mail from the WordPress host addressed to recipients unrelated to normal property inquiries.
Web server access logs showing repeated unauthenticated POST requests to the Estatik property request form endpoint.
Bounce messages or abuse complaints referencing subject lines and bodies that do not match legitimate real estate inquiries.
Reply-To headers on outbound mail that point to attacker-controlled addresses distinct from the site's configured agent contacts.

Detection Strategies

Inspect mail server logs for messages originating from the WordPress instance whose To addresses fall outside the configured agent or admin list.
Correlate web request volume against the property request form endpoint with outbound SMTP transaction counts to identify anomalous relay activity.
Query the installed Estatik plugin version across managed WordPress sites and flag any instance below 4.3.4.

Monitoring Recommendations

Enable and retain WordPress mail logs to capture recipient, subject, and header data for every message generated by plugins.
Alert on sudden spikes in outbound email volume from web application hosts that are not designated mail relays.
Monitor domain reputation and DMARC aggregate reports for evidence of unauthorized mail sent through the site's domain.

How to Mitigate CVE-2026-18044

Immediate Actions Required

Upgrade the Estatik Real Estate Plugin to version 4.3.4 or later on every affected WordPress site.
Review recent outbound mail from affected hosts and notify recipients of any confirmed phishing messages.
Rotate any credentials or tokens that may have been requested through fraudulent messages sent via the abused form.

Patch Information

The vendor addressed the issue in Estatik Real Estate Plugin version 4.3.4 by validating the recipient against the configured trusted address before dispatching the message. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the Estatik property request form until the plugin is upgraded to 4.3.4.
Reconfigure the form to use the default recipient routing rather than a custom address, which removes the vulnerable code path.
Restrict outbound SMTP from the WordPress host to known destinations at the mail gateway or firewall to contain relay abuse.

bash

# Verify the installed Estatik plugin version and upgrade via WP-CLI
wp plugin get estatik --field=version
wp plugin update estatik --version=4.3.4