high7.5
CVE-2026-16262
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthentica…
Impact
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
Affected products
| Product | Affected versions |
|---|---|
| Estatik Real Estate Plugin WordPress Plugin | before 4.3.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.